Analysis

  • max time kernel
    152s
  • max time network
    161s
  • platform
    windows10_x64
  • resource
    win10v20210408
  • submitted
    03/09/2021, 14:17

General

  • Target
    F69BB2AF3DBB3FAC27F3CFFFDDF2993B.exe
  • Size 4.3MB
  • Sample210903-rlqvvagean
  • SHA256 01f4e7e10bb524b04e6c8e731f51b600ad5948e1001531b05df57eb3c5f2d0ef
  • MD5 SHA1 SHA512

Malware Config

Extracted

Family
  • vidar

Version
  • 40.1

Botnet
  • 706

C2
  • https://eduarroma.tumblr.com/

Attributes
  • profile_id

    706

Extracted

Family
  • smokeloader

Version
  • 2020

C2
  • http://aucmoney.com/upload/

  • http://thegymmum.com/upload/

  • http://atvcampingtrips.com/upload/

  • http://kuapakualaman.com/upload/

  • http://renatazarazua.com/upload/

  • http://nasufmutlu.com/upload/

rc4.i32
rc4.i32

Extracted

Family
  • redline

Botnet
  • pub1

C2
  • viacetequn.site:80

Extracted

Family
  • raccoon

Botnet
  • b8ef25fa9e346b7a31e4b6ff160623dd5fed2474

Attributes
  • url4cnc

    https://telete.in/iphbarberleo

rc4.plain
rc4.plain

Extracted

Family
  • raccoon

Botnet
  • 2d1fa8a1b3c606f582add005087c86b4317a0710

Attributes
  • url4cnc

    https://telete.in/bimboDinotrex

rc4.plain
rc4.plain

Extracted

Family
  • vidar

Version
  • 40.4

Botnet
  • 937

C2
  • https://romkaxarit.tumblr.com/

Attributes
  • profile_id

    937

Signatures

  • Modifies Windows Defender Real-time Protection settings 3 TTPs
  • Process spawned unexpected child process 2 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • Raccoon

    Simple but powerful infostealer which was very active in 2019.

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine Payload 10 IoCs
  • SmokeLoader

    Modular backdoor trojan in use since 2014.

  • Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs
  • Vidar

    Vidar is an infostealer based on Arkei stealer.

  • suricata: ET MALWARE Suspicious Zipped Filename in Outbound POST Request (Passwords.txt)

    suricata: ET MALWARE Suspicious Zipped Filename in Outbound POST Request (Passwords.txt)

  • suricata: ET MALWARE Vidar/Arkei Stealer Client Data Upload

    suricata: ET MALWARE Vidar/Arkei Stealer Client Data Upload

  • suricata: ET MALWARE Vidar/Arkei/Megumin/Oski Stealer Data Exfil

    suricata: ET MALWARE Vidar/Arkei/Megumin/Oski Stealer Data Exfil

  • Vidar Stealer 5 IoCs
  • ASPack v2.12-2.42 7 IoCs

    Detects executables packed with ASPack v2.12-2.42

  • Downloads MZ/PE file
  • Executes dropped EXE 14 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL 8 IoCs
  • Themida packer 1 IoCs

    Detects Themida, an advanced Windows software protection system.

  • Adds Run key to start application 2 TTPs 2 IoCs
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs
  • Looks up external IP address via web service 8 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Program crash 17 IoCs
  • Checks SCSI registry key(s) 3 TTPs 3 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Creates scheduled task(s) 1 TTPs 2 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Delays execution with timeout.exe 2 IoCs
  • Kills process with taskkill 4 IoCs
  • Modifies data under HKEY_USERS 5 IoCs
  • Modifies registry class 10 IoCs
  • Runs ping.exe 1 TTPs 1 IoCs
  • Script User-Agent 3 IoCs

    Uses user-agent string associated with script host/environment.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: MapViewOfSection 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 22 IoCs
  • Suspicious use of FindShellTrayWindow 9 IoCs
  • Suspicious use of SendNotifyMessage 9 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • c:\windows\system32\svchost.exe
    c:\windows\system32\svchost.exe -k netsvcs -s gpsvc
    1⤵
      PID:64
    • c:\windows\system32\svchost.exe
      c:\windows\system32\svchost.exe -k netsvcs -s Schedule
      1⤵
        PID:1044
      • c:\windows\system32\svchost.exe
        c:\windows\system32\svchost.exe -k netsvcs -s Browser
        1⤵
          PID:2632
        • c:\windows\system32\svchost.exe
          c:\windows\system32\svchost.exe -k netsvcs -s WpnService
          1⤵
            PID:2624
          • c:\windows\system32\svchost.exe
            c:\windows\system32\svchost.exe -k netsvcs -s Winmgmt
            1⤵
              PID:2616
            • c:\windows\system32\svchost.exe
              c:\windows\system32\svchost.exe -k netsvcs -s IKEEXT
              1⤵
                PID:2364
              • c:\windows\system32\svchost.exe
                c:\windows\system32\svchost.exe -k netsvcs -s LanmanServer
                1⤵
                  PID:2324
                • c:\windows\system32\svchost.exe
                  c:\windows\system32\svchost.exe -k netsvcs -s ShellHWDetection
                  1⤵
                    PID:1848
                  • c:\windows\system32\svchost.exe
                    c:\windows\system32\svchost.exe -k netsvcs -s SENS
                    1⤵
                      PID:1404
                    • c:\windows\system32\svchost.exe
                      c:\windows\system32\svchost.exe -k netsvcs -s UserManager
                      1⤵
                        PID:1248
                      • c:\windows\system32\svchost.exe
                        c:\windows\system32\svchost.exe -k netsvcs -s Themes
                        1⤵
                          PID:1204
                        • c:\windows\system32\svchost.exe
                          c:\windows\system32\svchost.exe -k netsvcs -s ProfSvc
                          1⤵
                            PID:1096
                          • C:\Users\Admin\AppData\Local\Temp\F69BB2AF3DBB3FAC27F3CFFFDDF2993B.exe
                            "C:\Users\Admin\AppData\Local\Temp\F69BB2AF3DBB3FAC27F3CFFFDDF2993B.exe"
                            1⤵
                            • Suspicious use of WriteProcessMemory
                            PID:648
                            • C:\Users\Admin\AppData\Local\Temp\7zS882489C4\setup_install.exe
                              "C:\Users\Admin\AppData\Local\Temp\7zS882489C4\setup_install.exe"
                              2⤵
                              • Executes dropped EXE
                              • Loads dropped DLL
                              • Suspicious use of WriteProcessMemory
                              PID:2692
                              • C:\Windows\SysWOW64\cmd.exe
                                C:\Windows\system32\cmd.exe /c powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp"
                                3⤵
                                • Suspicious use of WriteProcessMemory
                                PID:3684
                                • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                  powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp"
                                  4⤵
                                  • Suspicious behavior: EnumeratesProcesses
                                  • Suspicious use of AdjustPrivilegeToken
                                  PID:996
                              • C:\Windows\SysWOW64\cmd.exe
                                C:\Windows\system32\cmd.exe /c Sat049cec745dbb0.exe
                                3⤵
                                • Suspicious use of WriteProcessMemory
                                PID:3680
                                • C:\Users\Admin\AppData\Local\Temp\7zS882489C4\Sat049cec745dbb0.exe
                                  Sat049cec745dbb0.exe
                                  4⤵
                                  • Executes dropped EXE
                                  PID:4068
                                  • C:\Users\Admin\AppData\Local\Temp\7zS882489C4\Sat049cec745dbb0.exe
                                    "C:\Users\Admin\AppData\Local\Temp\7zS882489C4\Sat049cec745dbb0.exe" -a
                                    5⤵
                                      PID:2188
                                • C:\Windows\SysWOW64\cmd.exe
                                  C:\Windows\system32\cmd.exe /c Sat04b0aea94c969aef.exe
                                  3⤵
                                  • Suspicious use of WriteProcessMemory
                                  PID:1820
                                  • C:\Users\Admin\AppData\Local\Temp\7zS882489C4\Sat04b0aea94c969aef.exe
                                    Sat04b0aea94c969aef.exe
                                    4⤵
                                    • Executes dropped EXE
                                    • Checks SCSI registry key(s)
                                    • Suspicious behavior: EnumeratesProcesses
                                    • Suspicious behavior: MapViewOfSection
                                    PID:3936
                                • C:\Windows\SysWOW64\cmd.exe
                                  C:\Windows\system32\cmd.exe /c Sat04ab282c33a66.exe
                                  3⤵
                                  • Suspicious use of WriteProcessMemory
                                  PID:2296
                                  • C:\Users\Admin\AppData\Local\Temp\7zS882489C4\Sat04ab282c33a66.exe
                                    Sat04ab282c33a66.exe
                                    4⤵
                                    • Executes dropped EXE
                                    PID:3964
                                    • C:\Windows\SysWOW64\WerFault.exe
                                      C:\Windows\SysWOW64\WerFault.exe -u -p 3964 -s 1664
                                      5⤵
                                      • Suspicious use of NtCreateProcessExOtherParentProcess
                                      • Program crash
                                      • Suspicious use of AdjustPrivilegeToken
                                      PID:4508
                                • C:\Windows\SysWOW64\cmd.exe
                                  C:\Windows\system32\cmd.exe /c Sat049403b078c3b419d.exe
                                  3⤵
                                  • Suspicious use of WriteProcessMemory
                                  PID:1328
                                  • C:\Users\Admin\AppData\Local\Temp\7zS882489C4\Sat049403b078c3b419d.exe
                                    Sat049403b078c3b419d.exe
                                    4⤵
                                    • Executes dropped EXE
                                    PID:1920
                                • C:\Windows\SysWOW64\cmd.exe
                                  C:\Windows\system32\cmd.exe /c Sat0474d386f5494e4ae.exe
                                  3⤵
                                  • Suspicious use of WriteProcessMemory
                                  PID:4092
                                  • C:\Users\Admin\AppData\Local\Temp\7zS882489C4\Sat0474d386f5494e4ae.exe
                                    Sat0474d386f5494e4ae.exe
                                    4⤵
                                    • Executes dropped EXE
                                    • Checks computer location settings
                                    • Suspicious behavior: EnumeratesProcesses
                                    PID:3300
                                    • C:\Users\Admin\Documents\uZVCheWUqNIu6_si1mtq4Z8t.exe
                                      "C:\Users\Admin\Documents\uZVCheWUqNIu6_si1mtq4Z8t.exe"
                                      5⤵
                                        PID:4824
                                        • C:\Users\Admin\AppData\Roaming\2656924.exe
                                          "C:\Users\Admin\AppData\Roaming\2656924.exe"
                                          6⤵
                                            PID:5224
                                          • C:\Users\Admin\AppData\Roaming\2055182.exe
                                            "C:\Users\Admin\AppData\Roaming\2055182.exe"
                                            6⤵
                                              PID:5072
                                              • C:\Users\Admin\AppData\Roaming\WinHost\WinHoster.exe
                                                "C:\Users\Admin\AppData\Roaming\WinHost\WinHoster.exe"
                                                7⤵
                                                  PID:6592
                                              • C:\Users\Admin\AppData\Roaming\5344333.exe
                                                "C:\Users\Admin\AppData\Roaming\5344333.exe"
                                                6⤵
                                                  PID:5640
                                                • C:\Users\Admin\AppData\Roaming\8188357.exe
                                                  "C:\Users\Admin\AppData\Roaming\8188357.exe"
                                                  6⤵
                                                    PID:5768
                                                • C:\Users\Admin\Documents\cykMUarO8f8rIKgE_x5XA_uV.exe
                                                  "C:\Users\Admin\Documents\cykMUarO8f8rIKgE_x5XA_uV.exe"
                                                  5⤵
                                                    PID:4904
                                                  • C:\Users\Admin\Documents\AT0Rvt6cXnNjDM3gQM8j2g1W.exe
                                                    "C:\Users\Admin\Documents\AT0Rvt6cXnNjDM3gQM8j2g1W.exe"
                                                    5⤵
                                                      PID:4880
                                                      • C:\Users\Admin\AppData\Local\Temp\RarSFX0\DPRwKy.exe
                                                        "C:\Users\Admin\AppData\Local\Temp\RarSFX0\DPRwKy.exe"
                                                        6⤵
                                                          PID:5556
                                                          • C:\Windows\SysWOW64\WerFault.exe
                                                            C:\Windows\SysWOW64\WerFault.exe -u -p 5556 -s 272
                                                            7⤵
                                                            • Program crash
                                                            PID:5364
                                                      • C:\Users\Admin\Documents\hs6IYLPtnJMqeKvsmdS6Ji03.exe
                                                        "C:\Users\Admin\Documents\hs6IYLPtnJMqeKvsmdS6Ji03.exe"
                                                        5⤵
                                                          PID:4852
                                                        • C:\Users\Admin\Documents\GZzMS5pXBiIfS0OU2FBSOGEG.exe
                                                          "C:\Users\Admin\Documents\GZzMS5pXBiIfS0OU2FBSOGEG.exe"
                                                          5⤵
                                                            PID:4872
                                                            • C:\Users\Admin\Documents\GZzMS5pXBiIfS0OU2FBSOGEG.exe
                                                              "C:\Users\Admin\Documents\GZzMS5pXBiIfS0OU2FBSOGEG.exe"
                                                              6⤵
                                                                PID:6388
                                                            • C:\Users\Admin\Documents\u_G58DtmreA6CQDuAkPGdXoT.exe
                                                              "C:\Users\Admin\Documents\u_G58DtmreA6CQDuAkPGdXoT.exe"
                                                              5⤵
                                                                PID:4796
                                                              • C:\Users\Admin\Documents\SpmDtMHxFH5pnn43ZJ2Y1L5G.exe
                                                                "C:\Users\Admin\Documents\SpmDtMHxFH5pnn43ZJ2Y1L5G.exe"
                                                                5⤵
                                                                  PID:4756
                                                                  • C:\Windows\SysWOW64\mshta.exe
                                                                    "C:\Windows\System32\mshta.exe" VbScRIpt: CloSE ( CReATEobJECT ( "WscrIpt.SheLL"). Run ( "cmD.exe /Q /c TYPE ""C:\Users\Admin\Documents\SpmDtMHxFH5pnn43ZJ2Y1L5G.exe"" > X4d4XArNWDu.eXE && StArt X4D4XarNWDu.Exe -PXPoqL0iOUHHP7hXFattB5ZvsV & if """" == """" for %A IN ( ""C:\Users\Admin\Documents\SpmDtMHxFH5pnn43ZJ2Y1L5G.exe"" ) do taskkill /f -im ""%~nxA"" " , 0 , trUE ) )
                                                                    6⤵
                                                                      PID:4648
                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                        "C:\Windows\System32\cmd.exe" /Q /c TYPE "C:\Users\Admin\Documents\SpmDtMHxFH5pnn43ZJ2Y1L5G.exe"> X4d4XArNWDu.eXE && StArt X4D4XarNWDu.Exe -PXPoqL0iOUHHP7hXFattB5ZvsV & if "" == "" for %A IN ( "C:\Users\Admin\Documents\SpmDtMHxFH5pnn43ZJ2Y1L5G.exe" ) do taskkill /f -im "%~nxA"
                                                                        7⤵
                                                                          PID:4020
                                                                          • C:\Users\Admin\AppData\Local\Temp\X4d4XArNWDu.eXE
                                                                            X4D4XarNWDu.Exe -PXPoqL0iOUHHP7hXFattB5ZvsV
                                                                            8⤵
                                                                              PID:5416
                                                                              • C:\Windows\SysWOW64\mshta.exe
                                                                                "C:\Windows\System32\mshta.exe" VbScRIpt: CloSE ( CReATEobJECT ( "WscrIpt.SheLL"). Run ( "cmD.exe /Q /c TYPE ""C:\Users\Admin\AppData\Local\Temp\X4d4XArNWDu.eXE"" > X4d4XArNWDu.eXE && StArt X4D4XarNWDu.Exe -PXPoqL0iOUHHP7hXFattB5ZvsV & if ""-PXPoqL0iOUHHP7hXFattB5ZvsV "" == """" for %A IN ( ""C:\Users\Admin\AppData\Local\Temp\X4d4XArNWDu.eXE"" ) do taskkill /f -im ""%~nxA"" " , 0 , trUE ) )
                                                                                9⤵
                                                                                  PID:7596
                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                    "C:\Windows\System32\cmd.exe" /Q /c TYPE "C:\Users\Admin\AppData\Local\Temp\X4d4XArNWDu.eXE"> X4d4XArNWDu.eXE && StArt X4D4XarNWDu.Exe -PXPoqL0iOUHHP7hXFattB5ZvsV & if "-PXPoqL0iOUHHP7hXFattB5ZvsV " == "" for %A IN ( "C:\Users\Admin\AppData\Local\Temp\X4d4XArNWDu.eXE" ) do taskkill /f -im "%~nxA"
                                                                                    10⤵
                                                                                      PID:6532
                                                                                  • C:\Windows\SysWOW64\regsvr32.exe
                                                                                    "C:\Windows\System32\regsvr32.exe" -S fOUT6o7J.Mj
                                                                                    9⤵
                                                                                      PID:8832
                                                                                  • C:\Windows\SysWOW64\taskkill.exe
                                                                                    taskkill /f -im "SpmDtMHxFH5pnn43ZJ2Y1L5G.exe"
                                                                                    8⤵
                                                                                    • Kills process with taskkill
                                                                                    PID:6712
                                                                            • C:\Users\Admin\Documents\Z0Rm7HxNN9vCs2Zdr9JJ3dab.exe
                                                                              "C:\Users\Admin\Documents\Z0Rm7HxNN9vCs2Zdr9JJ3dab.exe"
                                                                              5⤵
                                                                                PID:4740
                                                                                • C:\Users\Admin\Documents\Z0Rm7HxNN9vCs2Zdr9JJ3dab.exe
                                                                                  C:\Users\Admin\Documents\Z0Rm7HxNN9vCs2Zdr9JJ3dab.exe
                                                                                  6⤵
                                                                                    PID:5128
                                                                                  • C:\Users\Admin\Documents\Z0Rm7HxNN9vCs2Zdr9JJ3dab.exe
                                                                                    C:\Users\Admin\Documents\Z0Rm7HxNN9vCs2Zdr9JJ3dab.exe
                                                                                    6⤵
                                                                                      PID:5356
                                                                                    • C:\Users\Admin\Documents\Z0Rm7HxNN9vCs2Zdr9JJ3dab.exe
                                                                                      C:\Users\Admin\Documents\Z0Rm7HxNN9vCs2Zdr9JJ3dab.exe
                                                                                      6⤵
                                                                                        PID:5724
                                                                                      • C:\Users\Admin\Documents\Z0Rm7HxNN9vCs2Zdr9JJ3dab.exe
                                                                                        C:\Users\Admin\Documents\Z0Rm7HxNN9vCs2Zdr9JJ3dab.exe
                                                                                        6⤵
                                                                                          PID:5972
                                                                                        • C:\Users\Admin\Documents\Z0Rm7HxNN9vCs2Zdr9JJ3dab.exe
                                                                                          C:\Users\Admin\Documents\Z0Rm7HxNN9vCs2Zdr9JJ3dab.exe
                                                                                          6⤵
                                                                                            PID:5388
                                                                                          • C:\Users\Admin\Documents\Z0Rm7HxNN9vCs2Zdr9JJ3dab.exe
                                                                                            C:\Users\Admin\Documents\Z0Rm7HxNN9vCs2Zdr9JJ3dab.exe
                                                                                            6⤵
                                                                                              PID:4728
                                                                                            • C:\Users\Admin\Documents\Z0Rm7HxNN9vCs2Zdr9JJ3dab.exe
                                                                                              C:\Users\Admin\Documents\Z0Rm7HxNN9vCs2Zdr9JJ3dab.exe
                                                                                              6⤵
                                                                                                PID:5148
                                                                                              • C:\Users\Admin\Documents\Z0Rm7HxNN9vCs2Zdr9JJ3dab.exe
                                                                                                C:\Users\Admin\Documents\Z0Rm7HxNN9vCs2Zdr9JJ3dab.exe
                                                                                                6⤵
                                                                                                  PID:5740
                                                                                                • C:\Users\Admin\Documents\Z0Rm7HxNN9vCs2Zdr9JJ3dab.exe
                                                                                                  C:\Users\Admin\Documents\Z0Rm7HxNN9vCs2Zdr9JJ3dab.exe
                                                                                                  6⤵
                                                                                                    PID:4352
                                                                                                  • C:\Users\Admin\Documents\Z0Rm7HxNN9vCs2Zdr9JJ3dab.exe
                                                                                                    C:\Users\Admin\Documents\Z0Rm7HxNN9vCs2Zdr9JJ3dab.exe
                                                                                                    6⤵
                                                                                                      PID:4528
                                                                                                    • C:\Users\Admin\Documents\Z0Rm7HxNN9vCs2Zdr9JJ3dab.exe
                                                                                                      C:\Users\Admin\Documents\Z0Rm7HxNN9vCs2Zdr9JJ3dab.exe
                                                                                                      6⤵
                                                                                                        PID:5504
                                                                                                      • C:\Users\Admin\Documents\Z0Rm7HxNN9vCs2Zdr9JJ3dab.exe
                                                                                                        C:\Users\Admin\Documents\Z0Rm7HxNN9vCs2Zdr9JJ3dab.exe
                                                                                                        6⤵
                                                                                                          PID:6240
                                                                                                        • C:\Users\Admin\Documents\Z0Rm7HxNN9vCs2Zdr9JJ3dab.exe
                                                                                                          C:\Users\Admin\Documents\Z0Rm7HxNN9vCs2Zdr9JJ3dab.exe
                                                                                                          6⤵
                                                                                                            PID:6652
                                                                                                          • C:\Users\Admin\Documents\Z0Rm7HxNN9vCs2Zdr9JJ3dab.exe
                                                                                                            C:\Users\Admin\Documents\Z0Rm7HxNN9vCs2Zdr9JJ3dab.exe
                                                                                                            6⤵
                                                                                                              PID:6988
                                                                                                            • C:\Users\Admin\Documents\Z0Rm7HxNN9vCs2Zdr9JJ3dab.exe
                                                                                                              C:\Users\Admin\Documents\Z0Rm7HxNN9vCs2Zdr9JJ3dab.exe
                                                                                                              6⤵
                                                                                                                PID:3180
                                                                                                              • C:\Users\Admin\Documents\Z0Rm7HxNN9vCs2Zdr9JJ3dab.exe
                                                                                                                C:\Users\Admin\Documents\Z0Rm7HxNN9vCs2Zdr9JJ3dab.exe
                                                                                                                6⤵
                                                                                                                  PID:6668
                                                                                                                • C:\Users\Admin\Documents\Z0Rm7HxNN9vCs2Zdr9JJ3dab.exe
                                                                                                                  C:\Users\Admin\Documents\Z0Rm7HxNN9vCs2Zdr9JJ3dab.exe
                                                                                                                  6⤵
                                                                                                                    PID:7096
                                                                                                                  • C:\Users\Admin\Documents\Z0Rm7HxNN9vCs2Zdr9JJ3dab.exe
                                                                                                                    C:\Users\Admin\Documents\Z0Rm7HxNN9vCs2Zdr9JJ3dab.exe
                                                                                                                    6⤵
                                                                                                                      PID:6540
                                                                                                                    • C:\Users\Admin\Documents\Z0Rm7HxNN9vCs2Zdr9JJ3dab.exe
                                                                                                                      C:\Users\Admin\Documents\Z0Rm7HxNN9vCs2Zdr9JJ3dab.exe
                                                                                                                      6⤵
                                                                                                                        PID:6936
                                                                                                                      • C:\Users\Admin\Documents\Z0Rm7HxNN9vCs2Zdr9JJ3dab.exe
                                                                                                                        C:\Users\Admin\Documents\Z0Rm7HxNN9vCs2Zdr9JJ3dab.exe
                                                                                                                        6⤵
                                                                                                                          PID:6968
                                                                                                                        • C:\Users\Admin\Documents\Z0Rm7HxNN9vCs2Zdr9JJ3dab.exe
                                                                                                                          C:\Users\Admin\Documents\Z0Rm7HxNN9vCs2Zdr9JJ3dab.exe
                                                                                                                          6⤵
                                                                                                                            PID:4856
                                                                                                                          • C:\Users\Admin\Documents\Z0Rm7HxNN9vCs2Zdr9JJ3dab.exe
                                                                                                                            C:\Users\Admin\Documents\Z0Rm7HxNN9vCs2Zdr9JJ3dab.exe
                                                                                                                            6⤵
                                                                                                                              PID:7204
                                                                                                                            • C:\Users\Admin\Documents\Z0Rm7HxNN9vCs2Zdr9JJ3dab.exe
                                                                                                                              C:\Users\Admin\Documents\Z0Rm7HxNN9vCs2Zdr9JJ3dab.exe
                                                                                                                              6⤵
                                                                                                                                PID:7496
                                                                                                                              • C:\Users\Admin\Documents\Z0Rm7HxNN9vCs2Zdr9JJ3dab.exe
                                                                                                                                C:\Users\Admin\Documents\Z0Rm7HxNN9vCs2Zdr9JJ3dab.exe
                                                                                                                                6⤵
                                                                                                                                  PID:7772
                                                                                                                                • C:\Users\Admin\Documents\Z0Rm7HxNN9vCs2Zdr9JJ3dab.exe
                                                                                                                                  C:\Users\Admin\Documents\Z0Rm7HxNN9vCs2Zdr9JJ3dab.exe
                                                                                                                                  6⤵
                                                                                                                                    PID:7224
                                                                                                                                  • C:\Users\Admin\Documents\Z0Rm7HxNN9vCs2Zdr9JJ3dab.exe
                                                                                                                                    C:\Users\Admin\Documents\Z0Rm7HxNN9vCs2Zdr9JJ3dab.exe
                                                                                                                                    6⤵
                                                                                                                                      PID:8156
                                                                                                                                    • C:\Users\Admin\Documents\Z0Rm7HxNN9vCs2Zdr9JJ3dab.exe
                                                                                                                                      C:\Users\Admin\Documents\Z0Rm7HxNN9vCs2Zdr9JJ3dab.exe
                                                                                                                                      6⤵
                                                                                                                                        PID:7840
                                                                                                                                      • C:\Users\Admin\Documents\Z0Rm7HxNN9vCs2Zdr9JJ3dab.exe
                                                                                                                                        C:\Users\Admin\Documents\Z0Rm7HxNN9vCs2Zdr9JJ3dab.exe
                                                                                                                                        6⤵
                                                                                                                                          PID:8032
                                                                                                                                        • C:\Users\Admin\Documents\Z0Rm7HxNN9vCs2Zdr9JJ3dab.exe
                                                                                                                                          C:\Users\Admin\Documents\Z0Rm7HxNN9vCs2Zdr9JJ3dab.exe
                                                                                                                                          6⤵
                                                                                                                                            PID:8736
                                                                                                                                          • C:\Users\Admin\Documents\Z0Rm7HxNN9vCs2Zdr9JJ3dab.exe
                                                                                                                                            C:\Users\Admin\Documents\Z0Rm7HxNN9vCs2Zdr9JJ3dab.exe
                                                                                                                                            6⤵
                                                                                                                                              PID:7648
                                                                                                                                          • C:\Users\Admin\Documents\G2YVCJ0gNWqu3wmLooW2JcKb.exe
                                                                                                                                            "C:\Users\Admin\Documents\G2YVCJ0gNWqu3wmLooW2JcKb.exe"
                                                                                                                                            5⤵
                                                                                                                                              PID:4732
                                                                                                                                              • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                C:\Windows\SysWOW64\WerFault.exe -u -p 4732 -s 656
                                                                                                                                                6⤵
                                                                                                                                                • Program crash
                                                                                                                                                PID:5600
                                                                                                                                              • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                C:\Windows\SysWOW64\WerFault.exe -u -p 4732 -s 672
                                                                                                                                                6⤵
                                                                                                                                                • Program crash
                                                                                                                                                PID:5892
                                                                                                                                              • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                C:\Windows\SysWOW64\WerFault.exe -u -p 4732 -s 676
                                                                                                                                                6⤵
                                                                                                                                                • Program crash
                                                                                                                                                PID:5176
                                                                                                                                              • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                C:\Windows\SysWOW64\WerFault.exe -u -p 4732 -s 652
                                                                                                                                                6⤵
                                                                                                                                                • Program crash
                                                                                                                                                PID:5508
                                                                                                                                              • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                C:\Windows\SysWOW64\WerFault.exe -u -p 4732 -s 1120
                                                                                                                                                6⤵
                                                                                                                                                • Program crash
                                                                                                                                                PID:5104
                                                                                                                                              • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                C:\Windows\SysWOW64\WerFault.exe -u -p 4732 -s 1164
                                                                                                                                                6⤵
                                                                                                                                                • Program crash
                                                                                                                                                PID:6116
                                                                                                                                              • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                C:\Windows\SysWOW64\WerFault.exe -u -p 4732 -s 1136
                                                                                                                                                6⤵
                                                                                                                                                • Program crash
                                                                                                                                                PID:5460
                                                                                                                                              • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                C:\Windows\SysWOW64\WerFault.exe -u -p 4732 -s 1268
                                                                                                                                                6⤵
                                                                                                                                                • Program crash
                                                                                                                                                PID:6912
                                                                                                                                              • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                C:\Windows\SysWOW64\WerFault.exe -u -p 4732 -s 1280
                                                                                                                                                6⤵
                                                                                                                                                • Program crash
                                                                                                                                                PID:6224
                                                                                                                                            • C:\Users\Admin\Documents\tFJMgldm0F7jf0sO1SAZ05wY.exe
                                                                                                                                              "C:\Users\Admin\Documents\tFJMgldm0F7jf0sO1SAZ05wY.exe"
                                                                                                                                              5⤵
                                                                                                                                                PID:2760
                                                                                                                                                • C:\Windows\System32\Conhost.exe
                                                                                                                                                  \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                  6⤵
                                                                                                                                                    PID:4000
                                                                                                                                                • C:\Users\Admin\Documents\C1WNGsKR003k0bk8sRQN_Oah.exe
                                                                                                                                                  "C:\Users\Admin\Documents\C1WNGsKR003k0bk8sRQN_Oah.exe"
                                                                                                                                                  5⤵
                                                                                                                                                    PID:4684
                                                                                                                                                    • C:\Users\Admin\Documents\C1WNGsKR003k0bk8sRQN_Oah.exe
                                                                                                                                                      C:\Users\Admin\Documents\C1WNGsKR003k0bk8sRQN_Oah.exe
                                                                                                                                                      6⤵
                                                                                                                                                        PID:3064
                                                                                                                                                      • C:\Users\Admin\Documents\C1WNGsKR003k0bk8sRQN_Oah.exe
                                                                                                                                                        C:\Users\Admin\Documents\C1WNGsKR003k0bk8sRQN_Oah.exe
                                                                                                                                                        6⤵
                                                                                                                                                          PID:5368
                                                                                                                                                        • C:\Users\Admin\Documents\C1WNGsKR003k0bk8sRQN_Oah.exe
                                                                                                                                                          C:\Users\Admin\Documents\C1WNGsKR003k0bk8sRQN_Oah.exe
                                                                                                                                                          6⤵
                                                                                                                                                            PID:5688
                                                                                                                                                          • C:\Users\Admin\Documents\C1WNGsKR003k0bk8sRQN_Oah.exe
                                                                                                                                                            C:\Users\Admin\Documents\C1WNGsKR003k0bk8sRQN_Oah.exe
                                                                                                                                                            6⤵
                                                                                                                                                              PID:5928
                                                                                                                                                            • C:\Users\Admin\Documents\C1WNGsKR003k0bk8sRQN_Oah.exe
                                                                                                                                                              C:\Users\Admin\Documents\C1WNGsKR003k0bk8sRQN_Oah.exe
                                                                                                                                                              6⤵
                                                                                                                                                                PID:5260
                                                                                                                                                              • C:\Users\Admin\Documents\C1WNGsKR003k0bk8sRQN_Oah.exe
                                                                                                                                                                C:\Users\Admin\Documents\C1WNGsKR003k0bk8sRQN_Oah.exe
                                                                                                                                                                6⤵
                                                                                                                                                                  PID:4120
                                                                                                                                                                • C:\Users\Admin\Documents\C1WNGsKR003k0bk8sRQN_Oah.exe
                                                                                                                                                                  C:\Users\Admin\Documents\C1WNGsKR003k0bk8sRQN_Oah.exe
                                                                                                                                                                  6⤵
                                                                                                                                                                    PID:5136
                                                                                                                                                                  • C:\Users\Admin\Documents\C1WNGsKR003k0bk8sRQN_Oah.exe
                                                                                                                                                                    C:\Users\Admin\Documents\C1WNGsKR003k0bk8sRQN_Oah.exe
                                                                                                                                                                    6⤵
                                                                                                                                                                      PID:5912
                                                                                                                                                                    • C:\Users\Admin\Documents\C1WNGsKR003k0bk8sRQN_Oah.exe
                                                                                                                                                                      C:\Users\Admin\Documents\C1WNGsKR003k0bk8sRQN_Oah.exe
                                                                                                                                                                      6⤵
                                                                                                                                                                        PID:852
                                                                                                                                                                      • C:\Users\Admin\Documents\C1WNGsKR003k0bk8sRQN_Oah.exe
                                                                                                                                                                        C:\Users\Admin\Documents\C1WNGsKR003k0bk8sRQN_Oah.exe
                                                                                                                                                                        6⤵
                                                                                                                                                                          PID:4144
                                                                                                                                                                        • C:\Users\Admin\Documents\C1WNGsKR003k0bk8sRQN_Oah.exe
                                                                                                                                                                          C:\Users\Admin\Documents\C1WNGsKR003k0bk8sRQN_Oah.exe
                                                                                                                                                                          6⤵
                                                                                                                                                                            PID:5300
                                                                                                                                                                          • C:\Users\Admin\Documents\C1WNGsKR003k0bk8sRQN_Oah.exe
                                                                                                                                                                            C:\Users\Admin\Documents\C1WNGsKR003k0bk8sRQN_Oah.exe
                                                                                                                                                                            6⤵
                                                                                                                                                                              PID:6292
                                                                                                                                                                            • C:\Users\Admin\Documents\C1WNGsKR003k0bk8sRQN_Oah.exe
                                                                                                                                                                              C:\Users\Admin\Documents\C1WNGsKR003k0bk8sRQN_Oah.exe
                                                                                                                                                                              6⤵
                                                                                                                                                                                PID:6708
                                                                                                                                                                              • C:\Users\Admin\Documents\C1WNGsKR003k0bk8sRQN_Oah.exe
                                                                                                                                                                                C:\Users\Admin\Documents\C1WNGsKR003k0bk8sRQN_Oah.exe
                                                                                                                                                                                6⤵
                                                                                                                                                                                  PID:7024
                                                                                                                                                                                • C:\Users\Admin\Documents\C1WNGsKR003k0bk8sRQN_Oah.exe
                                                                                                                                                                                  C:\Users\Admin\Documents\C1WNGsKR003k0bk8sRQN_Oah.exe
                                                                                                                                                                                  6⤵
                                                                                                                                                                                    PID:4296
                                                                                                                                                                                  • C:\Users\Admin\Documents\C1WNGsKR003k0bk8sRQN_Oah.exe
                                                                                                                                                                                    C:\Users\Admin\Documents\C1WNGsKR003k0bk8sRQN_Oah.exe
                                                                                                                                                                                    6⤵
                                                                                                                                                                                      PID:6760
                                                                                                                                                                                    • C:\Users\Admin\Documents\C1WNGsKR003k0bk8sRQN_Oah.exe
                                                                                                                                                                                      C:\Users\Admin\Documents\C1WNGsKR003k0bk8sRQN_Oah.exe
                                                                                                                                                                                      6⤵
                                                                                                                                                                                        PID:1340
                                                                                                                                                                                      • C:\Users\Admin\Documents\C1WNGsKR003k0bk8sRQN_Oah.exe
                                                                                                                                                                                        C:\Users\Admin\Documents\C1WNGsKR003k0bk8sRQN_Oah.exe
                                                                                                                                                                                        6⤵
                                                                                                                                                                                          PID:4724
                                                                                                                                                                                        • C:\Users\Admin\Documents\C1WNGsKR003k0bk8sRQN_Oah.exe
                                                                                                                                                                                          C:\Users\Admin\Documents\C1WNGsKR003k0bk8sRQN_Oah.exe
                                                                                                                                                                                          6⤵
                                                                                                                                                                                            PID:3888
                                                                                                                                                                                          • C:\Users\Admin\Documents\C1WNGsKR003k0bk8sRQN_Oah.exe
                                                                                                                                                                                            C:\Users\Admin\Documents\C1WNGsKR003k0bk8sRQN_Oah.exe
                                                                                                                                                                                            6⤵
                                                                                                                                                                                              PID:4568
                                                                                                                                                                                            • C:\Users\Admin\Documents\C1WNGsKR003k0bk8sRQN_Oah.exe
                                                                                                                                                                                              C:\Users\Admin\Documents\C1WNGsKR003k0bk8sRQN_Oah.exe
                                                                                                                                                                                              6⤵
                                                                                                                                                                                                PID:6048
                                                                                                                                                                                              • C:\Users\Admin\Documents\C1WNGsKR003k0bk8sRQN_Oah.exe
                                                                                                                                                                                                C:\Users\Admin\Documents\C1WNGsKR003k0bk8sRQN_Oah.exe
                                                                                                                                                                                                6⤵
                                                                                                                                                                                                  PID:7248
                                                                                                                                                                                                • C:\Users\Admin\Documents\C1WNGsKR003k0bk8sRQN_Oah.exe
                                                                                                                                                                                                  C:\Users\Admin\Documents\C1WNGsKR003k0bk8sRQN_Oah.exe
                                                                                                                                                                                                  6⤵
                                                                                                                                                                                                    PID:7576
                                                                                                                                                                                                  • C:\Users\Admin\Documents\C1WNGsKR003k0bk8sRQN_Oah.exe
                                                                                                                                                                                                    C:\Users\Admin\Documents\C1WNGsKR003k0bk8sRQN_Oah.exe
                                                                                                                                                                                                    6⤵
                                                                                                                                                                                                      PID:7852
                                                                                                                                                                                                    • C:\Users\Admin\Documents\C1WNGsKR003k0bk8sRQN_Oah.exe
                                                                                                                                                                                                      C:\Users\Admin\Documents\C1WNGsKR003k0bk8sRQN_Oah.exe
                                                                                                                                                                                                      6⤵
                                                                                                                                                                                                        PID:7296
                                                                                                                                                                                                      • C:\Users\Admin\Documents\C1WNGsKR003k0bk8sRQN_Oah.exe
                                                                                                                                                                                                        C:\Users\Admin\Documents\C1WNGsKR003k0bk8sRQN_Oah.exe
                                                                                                                                                                                                        6⤵
                                                                                                                                                                                                          PID:8132
                                                                                                                                                                                                        • C:\Users\Admin\Documents\C1WNGsKR003k0bk8sRQN_Oah.exe
                                                                                                                                                                                                          C:\Users\Admin\Documents\C1WNGsKR003k0bk8sRQN_Oah.exe
                                                                                                                                                                                                          6⤵
                                                                                                                                                                                                            PID:6056
                                                                                                                                                                                                          • C:\Users\Admin\Documents\C1WNGsKR003k0bk8sRQN_Oah.exe
                                                                                                                                                                                                            C:\Users\Admin\Documents\C1WNGsKR003k0bk8sRQN_Oah.exe
                                                                                                                                                                                                            6⤵
                                                                                                                                                                                                              PID:8152
                                                                                                                                                                                                            • C:\Users\Admin\Documents\C1WNGsKR003k0bk8sRQN_Oah.exe
                                                                                                                                                                                                              C:\Users\Admin\Documents\C1WNGsKR003k0bk8sRQN_Oah.exe
                                                                                                                                                                                                              6⤵
                                                                                                                                                                                                                PID:8720
                                                                                                                                                                                                              • C:\Users\Admin\Documents\C1WNGsKR003k0bk8sRQN_Oah.exe
                                                                                                                                                                                                                C:\Users\Admin\Documents\C1WNGsKR003k0bk8sRQN_Oah.exe
                                                                                                                                                                                                                6⤵
                                                                                                                                                                                                                  PID:7852
                                                                                                                                                                                                              • C:\Users\Admin\Documents\CB6uzLlw6rXCUHpUYWggADdx.exe
                                                                                                                                                                                                                "C:\Users\Admin\Documents\CB6uzLlw6rXCUHpUYWggADdx.exe"
                                                                                                                                                                                                                5⤵
                                                                                                                                                                                                                  PID:1820
                                                                                                                                                                                                                  • C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                                                                    "C:\Program Files\Mozilla Firefox\firefox.exe"
                                                                                                                                                                                                                    6⤵
                                                                                                                                                                                                                      PID:5816
                                                                                                                                                                                                                      • C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                                                                        "C:\Program Files\Mozilla Firefox\firefox.exe"
                                                                                                                                                                                                                        7⤵
                                                                                                                                                                                                                          PID:5172
                                                                                                                                                                                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe"
                                                                                                                                                                                                                        6⤵
                                                                                                                                                                                                                          PID:7908
                                                                                                                                                                                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=89.0.4389.114 --initial-client-data=0xc8,0xcc,0xd0,0xa4,0xd4,0x7ffae3f34f50,0x7ffae3f34f60,0x7ffae3f34f70
                                                                                                                                                                                                                            7⤵
                                                                                                                                                                                                                              PID:7996
                                                                                                                                                                                                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1612,7555661412900949118,8332039838473244230,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1624 /prefetch:2
                                                                                                                                                                                                                              7⤵
                                                                                                                                                                                                                                PID:4248
                                                                                                                                                                                                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1612,7555661412900949118,8332039838473244230,131072 --lang=en-US --service-sandbox-type=network --mojo-platform-channel-handle=1672 /prefetch:8
                                                                                                                                                                                                                                7⤵
                                                                                                                                                                                                                                  PID:7060
                                                                                                                                                                                                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1612,7555661412900949118,8332039838473244230,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2236 /prefetch:8
                                                                                                                                                                                                                                  7⤵
                                                                                                                                                                                                                                    PID:2776
                                                                                                                                                                                                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1612,7555661412900949118,8332039838473244230,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2620 /prefetch:1
                                                                                                                                                                                                                                    7⤵
                                                                                                                                                                                                                                      PID:7616
                                                                                                                                                                                                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1612,7555661412900949118,8332039838473244230,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2628 /prefetch:1
                                                                                                                                                                                                                                      7⤵
                                                                                                                                                                                                                                        PID:8100
                                                                                                                                                                                                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1612,7555661412900949118,8332039838473244230,131072 --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3676 /prefetch:1
                                                                                                                                                                                                                                        7⤵
                                                                                                                                                                                                                                          PID:4220
                                                                                                                                                                                                                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1612,7555661412900949118,8332039838473244230,131072 --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3608 /prefetch:1
                                                                                                                                                                                                                                          7⤵
                                                                                                                                                                                                                                            PID:4952
                                                                                                                                                                                                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1612,7555661412900949118,8332039838473244230,131072 --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=4 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3404 /prefetch:1
                                                                                                                                                                                                                                            7⤵
                                                                                                                                                                                                                                              PID:5744
                                                                                                                                                                                                                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1612,7555661412900949118,8332039838473244230,131072 --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3800 /prefetch:1
                                                                                                                                                                                                                                              7⤵
                                                                                                                                                                                                                                                PID:6532
                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                              "cmd.exe" /C taskkill /F /PID 1820 && choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\Documents\CB6uzLlw6rXCUHpUYWggADdx.exe"
                                                                                                                                                                                                                                              6⤵
                                                                                                                                                                                                                                                PID:7952
                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                                                                                                                                                  taskkill /F /PID 1820
                                                                                                                                                                                                                                                  7⤵
                                                                                                                                                                                                                                                  • Kills process with taskkill
                                                                                                                                                                                                                                                  PID:5916
                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                "cmd.exe" /C taskkill /F /PID 1820 && choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\Documents\CB6uzLlw6rXCUHpUYWggADdx.exe"
                                                                                                                                                                                                                                                6⤵
                                                                                                                                                                                                                                                  PID:7944
                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                                                                                                                                                    taskkill /F /PID 1820
                                                                                                                                                                                                                                                    7⤵
                                                                                                                                                                                                                                                    • Kills process with taskkill
                                                                                                                                                                                                                                                    PID:6004
                                                                                                                                                                                                                                              • C:\Users\Admin\Documents\6C2y_Qvf8Vg2K1MYNq6SzO5l.exe
                                                                                                                                                                                                                                                "C:\Users\Admin\Documents\6C2y_Qvf8Vg2K1MYNq6SzO5l.exe"
                                                                                                                                                                                                                                                5⤵
                                                                                                                                                                                                                                                  PID:4680
                                                                                                                                                                                                                                                  • C:\Users\Admin\Documents\J77cmUgJX0OQi4nZtiqUPG2L.exe
                                                                                                                                                                                                                                                    "C:\Users\Admin\Documents\J77cmUgJX0OQi4nZtiqUPG2L.exe"
                                                                                                                                                                                                                                                    6⤵
                                                                                                                                                                                                                                                      PID:6748
                                                                                                                                                                                                                                                      • C:\Users\Admin\Documents\c_L6tjGCp9jqrE5xBPg3Sjie.exe
                                                                                                                                                                                                                                                        "C:\Users\Admin\Documents\c_L6tjGCp9jqrE5xBPg3Sjie.exe"
                                                                                                                                                                                                                                                        7⤵
                                                                                                                                                                                                                                                          PID:7528
                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Roaming\8369213.exe
                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Roaming\8369213.exe"
                                                                                                                                                                                                                                                            8⤵
                                                                                                                                                                                                                                                              PID:8252
                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Roaming\3859300.exe
                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Roaming\3859300.exe"
                                                                                                                                                                                                                                                              8⤵
                                                                                                                                                                                                                                                                PID:8332
                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Roaming\7148450.exe
                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Roaming\7148450.exe"
                                                                                                                                                                                                                                                                8⤵
                                                                                                                                                                                                                                                                  PID:8388
                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Roaming\5115431.exe
                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Roaming\5115431.exe"
                                                                                                                                                                                                                                                                  8⤵
                                                                                                                                                                                                                                                                    PID:8456
                                                                                                                                                                                                                                                                • C:\Users\Admin\Documents\CBmtoTBD7smXevU5aBIkBK7u.exe
                                                                                                                                                                                                                                                                  "C:\Users\Admin\Documents\CBmtoTBD7smXevU5aBIkBK7u.exe"
                                                                                                                                                                                                                                                                  7⤵
                                                                                                                                                                                                                                                                    PID:7532
                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                                                  schtasks /create /f /RU "Admin" /tr "C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe" /tn "PowerControl LG" /sc ONLOGON /rl HIGHEST
                                                                                                                                                                                                                                                                  6⤵
                                                                                                                                                                                                                                                                  • Creates scheduled task(s)
                                                                                                                                                                                                                                                                  PID:7112
                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                                                  schtasks /create /f /RU "Admin" /tr "C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe" /tn "PowerControl HR" /sc HOURLY /rl HIGHEST
                                                                                                                                                                                                                                                                  6⤵
                                                                                                                                                                                                                                                                  • Creates scheduled task(s)
                                                                                                                                                                                                                                                                  PID:7104
                                                                                                                                                                                                                                                              • C:\Users\Admin\Documents\B5LaoSPTQHdz76qqurUUDgD6.exe
                                                                                                                                                                                                                                                                "C:\Users\Admin\Documents\B5LaoSPTQHdz76qqurUUDgD6.exe"
                                                                                                                                                                                                                                                                5⤵
                                                                                                                                                                                                                                                                  PID:3192
                                                                                                                                                                                                                                                                  • C:\Users\Admin\Documents\B5LaoSPTQHdz76qqurUUDgD6.exe
                                                                                                                                                                                                                                                                    "C:\Users\Admin\Documents\B5LaoSPTQHdz76qqurUUDgD6.exe"
                                                                                                                                                                                                                                                                    6⤵
                                                                                                                                                                                                                                                                      PID:5868
                                                                                                                                                                                                                                                                    • C:\Users\Admin\Documents\B5LaoSPTQHdz76qqurUUDgD6.exe
                                                                                                                                                                                                                                                                      "C:\Users\Admin\Documents\B5LaoSPTQHdz76qqurUUDgD6.exe"
                                                                                                                                                                                                                                                                      6⤵
                                                                                                                                                                                                                                                                        PID:5904
                                                                                                                                                                                                                                                                    • C:\Users\Admin\Documents\vo9iQC9Z6LVExVfdIoUbXf40.exe
                                                                                                                                                                                                                                                                      "C:\Users\Admin\Documents\vo9iQC9Z6LVExVfdIoUbXf40.exe"
                                                                                                                                                                                                                                                                      5⤵
                                                                                                                                                                                                                                                                        PID:4632
                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                          cmd.exe /C timeout /T 10 /NOBREAK > Nul & Del /f /q "C:\Users\Admin\Documents\vo9iQC9Z6LVExVfdIoUbXf40.exe"
                                                                                                                                                                                                                                                                          6⤵
                                                                                                                                                                                                                                                                            PID:8948
                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\timeout.exe
                                                                                                                                                                                                                                                                              timeout /T 10 /NOBREAK
                                                                                                                                                                                                                                                                              7⤵
                                                                                                                                                                                                                                                                              • Delays execution with timeout.exe
                                                                                                                                                                                                                                                                              PID:9072
                                                                                                                                                                                                                                                                        • C:\Users\Admin\Documents\WKmyJpxIjs58aDbmTlNn5Bfz.exe
                                                                                                                                                                                                                                                                          "C:\Users\Admin\Documents\WKmyJpxIjs58aDbmTlNn5Bfz.exe"
                                                                                                                                                                                                                                                                          5⤵
                                                                                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                                                                                          PID:2188
                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                            "C:\Windows\System32\cmd.exe" /c taskkill /im WKmyJpxIjs58aDbmTlNn5Bfz.exe /f & timeout /t 6 & del /f /q "C:\Users\Admin\Documents\WKmyJpxIjs58aDbmTlNn5Bfz.exe" & del C:\ProgramData\*.dll & exit
                                                                                                                                                                                                                                                                            6⤵
                                                                                                                                                                                                                                                                              PID:6552
                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                                                                                                                                                                                taskkill /im WKmyJpxIjs58aDbmTlNn5Bfz.exe /f
                                                                                                                                                                                                                                                                                7⤵
                                                                                                                                                                                                                                                                                • Kills process with taskkill
                                                                                                                                                                                                                                                                                PID:3616
                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\timeout.exe
                                                                                                                                                                                                                                                                                timeout /t 6
                                                                                                                                                                                                                                                                                7⤵
                                                                                                                                                                                                                                                                                • Delays execution with timeout.exe
                                                                                                                                                                                                                                                                                PID:5920
                                                                                                                                                                                                                                                                          • C:\Users\Admin\Documents\KjiTS6NgouIE3RHh44Grexsv.exe
                                                                                                                                                                                                                                                                            "C:\Users\Admin\Documents\KjiTS6NgouIE3RHh44Grexsv.exe"
                                                                                                                                                                                                                                                                            5⤵
                                                                                                                                                                                                                                                                              PID:4592
                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                C:\Windows\SysWOW64\WerFault.exe -u -p 4592 -s 660
                                                                                                                                                                                                                                                                                6⤵
                                                                                                                                                                                                                                                                                • Program crash
                                                                                                                                                                                                                                                                                PID:4980
                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                C:\Windows\SysWOW64\WerFault.exe -u -p 4592 -s 664
                                                                                                                                                                                                                                                                                6⤵
                                                                                                                                                                                                                                                                                • Program crash
                                                                                                                                                                                                                                                                                PID:5636
                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                C:\Windows\SysWOW64\WerFault.exe -u -p 4592 -s 700
                                                                                                                                                                                                                                                                                6⤵
                                                                                                                                                                                                                                                                                • Program crash
                                                                                                                                                                                                                                                                                PID:6060
                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                C:\Windows\SysWOW64\WerFault.exe -u -p 4592 -s 672
                                                                                                                                                                                                                                                                                6⤵
                                                                                                                                                                                                                                                                                • Program crash
                                                                                                                                                                                                                                                                                PID:5172
                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                C:\Windows\SysWOW64\WerFault.exe -u -p 4592 -s 888
                                                                                                                                                                                                                                                                                6⤵
                                                                                                                                                                                                                                                                                • Program crash
                                                                                                                                                                                                                                                                                PID:5776
                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                C:\Windows\SysWOW64\WerFault.exe -u -p 4592 -s 1076
                                                                                                                                                                                                                                                                                6⤵
                                                                                                                                                                                                                                                                                • Program crash
                                                                                                                                                                                                                                                                                PID:5404
                                                                                                                                                                                                                                                                            • C:\Users\Admin\Documents\QKSJjOKEjIzk67cH95Tya2WM.exe
                                                                                                                                                                                                                                                                              "C:\Users\Admin\Documents\QKSJjOKEjIzk67cH95Tya2WM.exe"
                                                                                                                                                                                                                                                                              5⤵
                                                                                                                                                                                                                                                                                PID:4328
                                                                                                                                                                                                                                                                              • C:\Users\Admin\Documents\hewIosGtVOS7K4bNhUyPN7Gq.exe
                                                                                                                                                                                                                                                                                "C:\Users\Admin\Documents\hewIosGtVOS7K4bNhUyPN7Gq.exe"
                                                                                                                                                                                                                                                                                5⤵
                                                                                                                                                                                                                                                                                  PID:4428
                                                                                                                                                                                                                                                                                  • C:\Program Files (x86)\Company\NewProduct\inst001.exe
                                                                                                                                                                                                                                                                                    "C:\Program Files (x86)\Company\NewProduct\inst001.exe"
                                                                                                                                                                                                                                                                                    6⤵
                                                                                                                                                                                                                                                                                      PID:3160
                                                                                                                                                                                                                                                                                    • C:\Program Files (x86)\Company\NewProduct\cutm3.exe
                                                                                                                                                                                                                                                                                      "C:\Program Files (x86)\Company\NewProduct\cutm3.exe"
                                                                                                                                                                                                                                                                                      6⤵
                                                                                                                                                                                                                                                                                        PID:5496
                                                                                                                                                                                                                                                                                      • C:\Program Files (x86)\Company\NewProduct\md8_8eus.exe
                                                                                                                                                                                                                                                                                        "C:\Program Files (x86)\Company\NewProduct\md8_8eus.exe"
                                                                                                                                                                                                                                                                                        6⤵
                                                                                                                                                                                                                                                                                          PID:1888
                                                                                                                                                                                                                                                                                      • C:\Users\Admin\Documents\GxfnBu79usmBeEP_Kgos6T7y.exe
                                                                                                                                                                                                                                                                                        "C:\Users\Admin\Documents\GxfnBu79usmBeEP_Kgos6T7y.exe"
                                                                                                                                                                                                                                                                                        5⤵
                                                                                                                                                                                                                                                                                          PID:4816
                                                                                                                                                                                                                                                                                        • C:\Users\Admin\Documents\BqFSKp22nq9M7nz7ClmUvefM.exe
                                                                                                                                                                                                                                                                                          "C:\Users\Admin\Documents\BqFSKp22nq9M7nz7ClmUvefM.exe"
                                                                                                                                                                                                                                                                                          5⤵
                                                                                                                                                                                                                                                                                            PID:3680
                                                                                                                                                                                                                                                                                          • C:\Users\Admin\Documents\U5jyU_7lEHBkh7J1v858uozp.exe
                                                                                                                                                                                                                                                                                            "C:\Users\Admin\Documents\U5jyU_7lEHBkh7J1v858uozp.exe"
                                                                                                                                                                                                                                                                                            5⤵
                                                                                                                                                                                                                                                                                              PID:2164
                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Roaming\4698270.exe
                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Roaming\4698270.exe"
                                                                                                                                                                                                                                                                                                6⤵
                                                                                                                                                                                                                                                                                                  PID:3400
                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Roaming\8834420.exe
                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Roaming\8834420.exe"
                                                                                                                                                                                                                                                                                                  6⤵
                                                                                                                                                                                                                                                                                                    PID:6148
                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Roaming\2116966.exe
                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Roaming\2116966.exe"
                                                                                                                                                                                                                                                                                                    6⤵
                                                                                                                                                                                                                                                                                                      PID:6188
                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Roaming\2370108.exe
                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Roaming\2370108.exe"
                                                                                                                                                                                                                                                                                                      6⤵
                                                                                                                                                                                                                                                                                                        PID:6372
                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\Documents\U82NoNDb4r9mszLvKk_1F8H2.exe
                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\Documents\U82NoNDb4r9mszLvKk_1F8H2.exe"
                                                                                                                                                                                                                                                                                                      5⤵
                                                                                                                                                                                                                                                                                                        PID:4304
                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\Documents\U82NoNDb4r9mszLvKk_1F8H2.exe
                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\Documents\U82NoNDb4r9mszLvKk_1F8H2.exe" -u
                                                                                                                                                                                                                                                                                                          6⤵
                                                                                                                                                                                                                                                                                                            PID:5220
                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\Documents\mpKgdDuVSPgvlH4Q_b6wCac8.exe
                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\Documents\mpKgdDuVSPgvlH4Q_b6wCac8.exe"
                                                                                                                                                                                                                                                                                                          5⤵
                                                                                                                                                                                                                                                                                                            PID:5852
                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\is-9ANE8.tmp\mpKgdDuVSPgvlH4Q_b6wCac8.tmp
                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\is-9ANE8.tmp\mpKgdDuVSPgvlH4Q_b6wCac8.tmp" /SL5="$202FC,138429,56832,C:\Users\Admin\Documents\mpKgdDuVSPgvlH4Q_b6wCac8.exe"
                                                                                                                                                                                                                                                                                                              6⤵
                                                                                                                                                                                                                                                                                                                PID:6032
                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\is-8LC6H.tmp\Setup.exe
                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\is-8LC6H.tmp\Setup.exe" /Verysilent
                                                                                                                                                                                                                                                                                                                  7⤵
                                                                                                                                                                                                                                                                                                                    PID:6416
                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c Sat04427cb01d4e20c.exe
                                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                                            • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                                                                                                                            PID:2200
                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\7zS882489C4\Sat04427cb01d4e20c.exe
                                                                                                                                                                                                                                                                                                              Sat04427cb01d4e20c.exe
                                                                                                                                                                                                                                                                                                              4⤵
                                                                                                                                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                                                                                                                                              • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                                              PID:1380
                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c Sat045c58e4987b928d.exe
                                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                                            • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                                                                                                                            PID:3560
                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\7zS882489C4\Sat045c58e4987b928d.exe
                                                                                                                                                                                                                                                                                                              Sat045c58e4987b928d.exe
                                                                                                                                                                                                                                                                                                              4⤵
                                                                                                                                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                                                                                                                                              • Adds Run key to start application
                                                                                                                                                                                                                                                                                                              • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                                                                                                                              PID:3600
                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\dllhost.exe
                                                                                                                                                                                                                                                                                                                dllhost.exe
                                                                                                                                                                                                                                                                                                                5⤵
                                                                                                                                                                                                                                                                                                                  PID:2284
                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                  cmd /c cmd < Abbassero.wmv
                                                                                                                                                                                                                                                                                                                  5⤵
                                                                                                                                                                                                                                                                                                                    PID:3428
                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                      cmd
                                                                                                                                                                                                                                                                                                                      6⤵
                                                                                                                                                                                                                                                                                                                        PID:3728
                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\findstr.exe
                                                                                                                                                                                                                                                                                                                          findstr /V /R "^VHwgFRxzxxLcwcGoqrvwdRkyDDkqmNLTpdmTOMvFsotvynnSaSEGawtrcWKeGzUGIRjLVNzgHQJiNPZttzIGotBijvbSexZYgbNhjNWFndZB$" Rugiada.wmv
                                                                                                                                                                                                                                                                                                                          7⤵
                                                                                                                                                                                                                                                                                                                            PID:4000
                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Piu.exe.com
                                                                                                                                                                                                                                                                                                                            Piu.exe.com L
                                                                                                                                                                                                                                                                                                                            7⤵
                                                                                                                                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                            • Suspicious use of FindShellTrayWindow
                                                                                                                                                                                                                                                                                                                            • Suspicious use of SendNotifyMessage
                                                                                                                                                                                                                                                                                                                            PID:4208
                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Piu.exe.com
                                                                                                                                                                                                                                                                                                                              C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Piu.exe.com L
                                                                                                                                                                                                                                                                                                                              8⤵
                                                                                                                                                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                              • Suspicious use of FindShellTrayWindow
                                                                                                                                                                                                                                                                                                                              • Suspicious use of SendNotifyMessage
                                                                                                                                                                                                                                                                                                                              PID:4368
                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Piu.exe.com
                                                                                                                                                                                                                                                                                                                                C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Piu.exe.com L
                                                                                                                                                                                                                                                                                                                                9⤵
                                                                                                                                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                                • Suspicious use of FindShellTrayWindow
                                                                                                                                                                                                                                                                                                                                • Suspicious use of SendNotifyMessage
                                                                                                                                                                                                                                                                                                                                PID:4448
                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\PING.EXE
                                                                                                                                                                                                                                                                                                                            ping GFBFPSXA -n 30
                                                                                                                                                                                                                                                                                                                            7⤵
                                                                                                                                                                                                                                                                                                                            • Runs ping.exe
                                                                                                                                                                                                                                                                                                                            PID:4332
                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c Sat041c77a5398.exe
                                                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                                                    • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                                                                                                                                    PID:3492
                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\7zS882489C4\Sat041c77a5398.exe
                                                                                                                                                                                                                                                                                                                      Sat041c77a5398.exe
                                                                                                                                                                                                                                                                                                                      4⤵
                                                                                                                                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                                                      PID:1988
                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c Sat04c6bdf900.exe
                                                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                                                    • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                                                                                                                                    PID:4028
                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\7zS882489C4\Sat04c6bdf900.exe
                                                                                                                                                                                                                                                                                                                      Sat04c6bdf900.exe
                                                                                                                                                                                                                                                                                                                      4⤵
                                                                                                                                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                      PID:3200
                                                                                                                                                                                                                                                                                                              • \??\c:\windows\system32\svchost.exe
                                                                                                                                                                                                                                                                                                                c:\windows\system32\svchost.exe -k netsvcs -s BITS
                                                                                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                                                                                • Suspicious use of SetThreadContext
                                                                                                                                                                                                                                                                                                                • Modifies registry class
                                                                                                                                                                                                                                                                                                                • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                                                PID:356
                                                                                                                                                                                                                                                                                                                • C:\Windows\system32\svchost.exe
                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\svchost.exe -k SystemNetworkService
                                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                                  • Checks processor information in registry
                                                                                                                                                                                                                                                                                                                  • Modifies data under HKEY_USERS
                                                                                                                                                                                                                                                                                                                  • Modifies registry class
                                                                                                                                                                                                                                                                                                                  PID:4704
                                                                                                                                                                                                                                                                                                              • C:\Windows\system32\rundll32.exe
                                                                                                                                                                                                                                                                                                                rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
                                                                                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                                                                                • Process spawned unexpected child process
                                                                                                                                                                                                                                                                                                                PID:4588
                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                                                                                                                                                                                                  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
                                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                                  • Loads dropped DLL
                                                                                                                                                                                                                                                                                                                  • Modifies registry class
                                                                                                                                                                                                                                                                                                                  • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                                                                                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                                                  PID:4612
                                                                                                                                                                                                                                                                                                              • C:\Windows\system32\rundll32.exe
                                                                                                                                                                                                                                                                                                                rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
                                                                                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                                                                                • Process spawned unexpected child process
                                                                                                                                                                                                                                                                                                                PID:7900
                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                                                                                                                                                                                                  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
                                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                                    PID:7920
                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\575.exe
                                                                                                                                                                                                                                                                                                                  C:\Users\Admin\AppData\Local\Temp\575.exe
                                                                                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                                                                                    PID:8408

                                                                                                                                                                                                                                                                                                                  Network

                                                                                                                                                                                                                                                                                                                        MITRE ATT&CK Enterprise v6

                                                                                                                                                                                                                                                                                                                        Replay Monitor

                                                                                                                                                                                                                                                                                                                        Loading Replay Monitor...

                                                                                                                                                                                                                                                                                                                        Downloads

                                                                                                                                                                                                                                                                                                                        memory/64-239-0x0000027322C00000-0x0000027322C74000-memory.dmp

                                                                                                                                                                                                                                                                                                                        memory/356-245-0x0000017E21CD0000-0x0000017E21D44000-memory.dmp

                                                                                                                                                                                                                                                                                                                        memory/356-243-0x0000017E21C10000-0x0000017E21C5D000-memory.dmp

                                                                                                                                                                                                                                                                                                                        memory/996-289-0x0000000009230000-0x0000000009263000-memory.dmp

                                                                                                                                                                                                                                                                                                                        memory/996-220-0x00000000084A0000-0x00000000084A1000-memory.dmp

                                                                                                                                                                                                                                                                                                                        memory/996-209-0x0000000007D80000-0x0000000007D81000-memory.dmp

                                                                                                                                                                                                                                                                                                                        memory/996-188-0x0000000006F62000-0x0000000006F63000-memory.dmp

                                                                                                                                                                                                                                                                                                                        memory/996-182-0x0000000004940000-0x0000000004941000-memory.dmp

                                                                                                                                                                                                                                                                                                                        memory/996-207-0x00000000074C0000-0x00000000074C1000-memory.dmp

                                                                                                                                                                                                                                                                                                                        memory/996-184-0x00000000075A0000-0x00000000075A1000-memory.dmp

                                                                                                                                                                                                                                                                                                                        memory/996-348-0x00000000093A0000-0x00000000093A1000-memory.dmp

                                                                                                                                                                                                                                                                                                                        memory/996-216-0x0000000007CD0000-0x0000000007CD1000-memory.dmp

                                                                                                                                                                                                                                                                                                                        memory/996-217-0x0000000007D10000-0x0000000007D11000-memory.dmp

                                                                                                                                                                                                                                                                                                                        memory/996-186-0x0000000006F60000-0x0000000006F61000-memory.dmp

                                                                                                                                                                                                                                                                                                                        memory/996-298-0x00000000090F0000-0x00000000090F1000-memory.dmp

                                                                                                                                                                                                                                                                                                                        memory/996-363-0x0000000006F63000-0x0000000006F64000-memory.dmp

                                                                                                                                                                                                                                                                                                                        memory/996-287-0x000000007EC90000-0x000000007EC91000-memory.dmp

                                                                                                                                                                                                                                                                                                                        memory/996-364-0x0000000009770000-0x0000000009771000-memory.dmp

                                                                                                                                                                                                                                                                                                                        memory/996-206-0x0000000007450000-0x0000000007451000-memory.dmp

                                                                                                                                                                                                                                                                                                                        memory/996-203-0x00000000073B0000-0x00000000073B1000-memory.dmp

                                                                                                                                                                                                                                                                                                                        memory/1044-272-0x0000026E7ECB0000-0x0000026E7ED24000-memory.dmp

                                                                                                                                                                                                                                                                                                                        memory/1096-268-0x0000025761D60000-0x0000025761DD4000-memory.dmp

                                                                                                                                                                                                                                                                                                                        memory/1204-288-0x00000143C1F60000-0x00000143C1FD4000-memory.dmp

                                                                                                                                                                                                                                                                                                                        memory/1248-269-0x00000167FB370000-0x00000167FB3E4000-memory.dmp

                                                                                                                                                                                                                                                                                                                        memory/1380-180-0x0000000002630000-0x000000000264C000-memory.dmp

                                                                                                                                                                                                                                                                                                                        memory/1380-187-0x0000000002650000-0x0000000002652000-memory.dmp

                                                                                                                                                                                                                                                                                                                        memory/1380-175-0x0000000000760000-0x0000000000761000-memory.dmp

                                                                                                                                                                                                                                                                                                                        memory/1404-279-0x000001930B880000-0x000001930B8F4000-memory.dmp

                                                                                                                                                                                                                                                                                                                        memory/1820-418-0x0000000000890000-0x000000000091E000-memory.dmp

                                                                                                                                                                                                                                                                                                                        memory/1820-441-0x0000000004E30000-0x0000000004E31000-memory.dmp

                                                                                                                                                                                                                                                                                                                        memory/1820-432-0x0000000004E34000-0x0000000004E36000-memory.dmp

                                                                                                                                                                                                                                                                                                                        memory/1820-464-0x0000000004E32000-0x0000000004E33000-memory.dmp

                                                                                                                                                                                                                                                                                                                        memory/1820-423-0x0000000000400000-0x00000000005A2000-memory.dmp

                                                                                                                                                                                                                                                                                                                        memory/1848-284-0x000001F5312D0000-0x000001F531344000-memory.dmp

                                                                                                                                                                                                                                                                                                                        memory/1920-296-0x0000000004E60000-0x0000000004E61000-memory.dmp

                                                                                                                                                                                                                                                                                                                        memory/1920-292-0x00000000079E0000-0x00000000079E1000-memory.dmp

                                                                                                                                                                                                                                                                                                                        memory/1920-366-0x00000000080F0000-0x00000000080F1000-memory.dmp

                                                                                                                                                                                                                                                                                                                        memory/1920-281-0x00000000074D2000-0x00000000074D3000-memory.dmp

                                                                                                                                                                                                                                                                                                                        memory/1920-277-0x00000000074D0000-0x00000000074D1000-memory.dmp

                                                                                                                                                                                                                                                                                                                        memory/1920-341-0x00000000074D4000-0x00000000074D6000-memory.dmp

                                                                                                                                                                                                                                                                                                                        memory/1920-282-0x00000000074D3000-0x00000000074D4000-memory.dmp

                                                                                                                                                                                                                                                                                                                        memory/1920-263-0x00000000074E0000-0x00000000074E1000-memory.dmp

                                                                                                                                                                                                                                                                                                                        memory/1920-270-0x0000000000400000-0x0000000002CCD000-memory.dmp

                                                                                                                                                                                                                                                                                                                        memory/1920-256-0x0000000004AC0000-0x0000000004ADC000-memory.dmp

                                                                                                                                                                                                                                                                                                                        memory/1920-286-0x0000000004B80000-0x0000000004B9A000-memory.dmp

                                                                                                                                                                                                                                                                                                                        memory/1920-299-0x0000000004E80000-0x0000000004E81000-memory.dmp

                                                                                                                                                                                                                                                                                                                        memory/1920-249-0x00000000048C0000-0x00000000048EF000-memory.dmp

                                                                                                                                                                                                                                                                                                                        memory/1988-174-0x0000000000810000-0x0000000000811000-memory.dmp

                                                                                                                                                                                                                                                                                                                        memory/1988-181-0x000000001B490000-0x000000001B492000-memory.dmp

                                                                                                                                                                                                                                                                                                                        memory/2188-445-0x0000000000400000-0x0000000002BB0000-memory.dmp

                                                                                                                                                                                                                                                                                                                        memory/2188-401-0x0000000004800000-0x00000000048D3000-memory.dmp

                                                                                                                                                                                                                                                                                                                        memory/2324-267-0x000002E654120000-0x000002E654194000-memory.dmp

                                                                                                                                                                                                                                                                                                                        memory/2364-246-0x000001FF17DB0000-0x000001FF17E24000-memory.dmp

                                                                                                                                                                                                                                                                                                                        memory/2428-241-0x0000000000660000-0x0000000000676000-memory.dmp

                                                                                                                                                                                                                                                                                                                        memory/2616-274-0x0000022B92270000-0x0000022B922E4000-memory.dmp

                                                                                                                                                                                                                                                                                                                        memory/2624-283-0x0000025EC1740000-0x0000025EC17B4000-memory.dmp

                                                                                                                                                                                                                                                                                                                        memory/2632-247-0x000002F435380000-0x000002F4353F4000-memory.dmp

                                                                                                                                                                                                                                                                                                                        memory/2692-130-0x000000006FE40000-0x000000006FFC6000-memory.dmp

                                                                                                                                                                                                                                                                                                                        memory/2692-137-0x0000000064940000-0x0000000064959000-memory.dmp

                                                                                                                                                                                                                                                                                                                        memory/2692-129-0x000000006B440000-0x000000006B4CF000-memory.dmp

                                                                                                                                                                                                                                                                                                                        memory/2692-136-0x0000000064940000-0x0000000064959000-memory.dmp

                                                                                                                                                                                                                                                                                                                        memory/2692-134-0x0000000064940000-0x0000000064959000-memory.dmp

                                                                                                                                                                                                                                                                                                                        memory/2692-133-0x0000000064940000-0x0000000064959000-memory.dmp

                                                                                                                                                                                                                                                                                                                        memory/2692-131-0x000000006B280000-0x000000006B2A6000-memory.dmp

                                                                                                                                                                                                                                                                                                                        memory/2760-447-0x0000000004EC2000-0x0000000004EC3000-memory.dmp

                                                                                                                                                                                                                                                                                                                        memory/2760-428-0x0000000004EC0000-0x0000000004EC1000-memory.dmp

                                                                                                                                                                                                                                                                                                                        memory/2760-454-0x0000000004EC3000-0x0000000004EC4000-memory.dmp

                                                                                                                                                                                                                                                                                                                        memory/2760-404-0x0000000002B60000-0x0000000002C0E000-memory.dmp

                                                                                                                                                                                                                                                                                                                        memory/2760-461-0x0000000000400000-0x0000000002B59000-memory.dmp

                                                                                                                                                                                                                                                                                                                        memory/3064-458-0x0000000003110000-0x0000000003122000-memory.dmp

                                                                                                                                                                                                                                                                                                                        memory/3192-361-0x0000000004940000-0x0000000004941000-memory.dmp

                                                                                                                                                                                                                                                                                                                        memory/3192-353-0x0000000004970000-0x0000000004971000-memory.dmp

                                                                                                                                                                                                                                                                                                                        memory/3192-343-0x0000000000030000-0x0000000000031000-memory.dmp

                                                                                                                                                                                                                                                                                                                        memory/3192-365-0x00000000048D0000-0x0000000004DCE000-memory.dmp

                                                                                                                                                                                                                                                                                                                        memory/3200-214-0x000001C62AE70000-0x000001C62AF54000-memory.dmp

                                                                                                                                                                                                                                                                                                                        memory/3200-215-0x000001C62B0C0000-0x000001C62B221000-memory.dmp

                                                                                                                                                                                                                                                                                                                        memory/3300-212-0x0000000003D00000-0x0000000003E3F000-memory.dmp

                                                                                                                                                                                                                                                                                                                        memory/3936-194-0x00000000023B0000-0x000000000245E000-memory.dmp

                                                                                                                                                                                                                                                                                                                        memory/3936-197-0x0000000000400000-0x00000000023AF000-memory.dmp

                                                                                                                                                                                                                                                                                                                        memory/3964-193-0x00000000040C0000-0x000000000415D000-memory.dmp

                                                                                                                                                                                                                                                                                                                        memory/3964-196-0x0000000000400000-0x0000000002403000-memory.dmp

                                                                                                                                                                                                                                                                                                                        memory/4612-240-0x0000000004620000-0x000000000467F000-memory.dmp

                                                                                                                                                                                                                                                                                                                        memory/4612-236-0x0000000001083000-0x0000000001184000-memory.dmp

                                                                                                                                                                                                                                                                                                                        memory/4632-350-0x0000000000C50000-0x0000000001203000-memory.dmp

                                                                                                                                                                                                                                                                                                                        memory/4684-367-0x0000000004890000-0x0000000004891000-memory.dmp

                                                                                                                                                                                                                                                                                                                        memory/4684-369-0x0000000004AD0000-0x0000000004AD1000-memory.dmp

                                                                                                                                                                                                                                                                                                                        memory/4684-354-0x0000000000060000-0x0000000000061000-memory.dmp

                                                                                                                                                                                                                                                                                                                        memory/4704-238-0x0000027D5B340000-0x0000027D5B3B4000-memory.dmp

                                                                                                                                                                                                                                                                                                                        memory/4732-406-0x00000000001C0000-0x00000000001EF000-memory.dmp

                                                                                                                                                                                                                                                                                                                        memory/4732-437-0x0000000000400000-0x0000000002B51000-memory.dmp

                                                                                                                                                                                                                                                                                                                        memory/4740-355-0x0000000000470000-0x0000000000471000-memory.dmp

                                                                                                                                                                                                                                                                                                                        memory/4740-386-0x0000000004C80000-0x0000000004CF6000-memory.dmp

                                                                                                                                                                                                                                                                                                                        memory/4824-356-0x00000000017E0000-0x00000000017F8000-memory.dmp

                                                                                                                                                                                                                                                                                                                        memory/4824-373-0x000000001BDD0000-0x000000001BDD2000-memory.dmp

                                                                                                                                                                                                                                                                                                                        memory/4824-345-0x0000000000FB0000-0x0000000000FB1000-memory.dmp

                                                                                                                                                                                                                                                                                                                        memory/4852-375-0x00000000779F0000-0x0000000077B7E000-memory.dmp

                                                                                                                                                                                                                                                                                                                        memory/4852-376-0x00000000003B0000-0x00000000003B1000-memory.dmp

                                                                                                                                                                                                                                                                                                                        memory/4852-399-0x0000000005700000-0x0000000005701000-memory.dmp

                                                                                                                                                                                                                                                                                                                        memory/4872-383-0x0000000007E20000-0x000000000831E000-memory.dmp

                                                                                                                                                                                                                                                                                                                        memory/4872-390-0x0000000008010000-0x0000000008026000-memory.dmp

                                                                                                                                                                                                                                                                                                                        memory/4872-342-0x0000000000ED0000-0x0000000000ED1000-memory.dmp

                                                                                                                                                                                                                                                                                                                        memory/4904-352-0x00000000010E0000-0x0000000001692000-memory.dmp

                                                                                                                                                                                                                                                                                                                        memory/5128-453-0x0000000005000000-0x0000000005606000-memory.dmp